Loading story…
South Korean authorities and security researchers disclosed a watering-hole campaign that compromised at least 15 legitimate domestic websites and abused vulnerable AnySign4PC software to install the SIGNBT and COPPERHEDGE backdoors on visitors' systems without user prompts. KISA said versions 1.1.4.4 through 1.1.4.6 were affected by a buffer-overflow flaw enabling remote code execution, with 1.1.5.0 identified as the patched release. Investigators said the activity ran from the second half of 2025 into 2026 and found related targeting across 72 organizations.
Technical reporting from ENKI, AhnLab, and other researchers described exploit chains in which malicious JavaScript on hacked sites used WebSocket communication with local security software, executed shellcode, injected into legitimate Microsoft processes, stored encrypted data in the registry, and loaded payloads directly in memory. Separate analysis tied the malware cluster to SIGNBT and highlighted overlap with some Gunra ransomware intrusions, including shared infrastructure, filenames, exploit paths, and anti-forensic behavior, but the current advisory stopped short of formally attributing the broader campaign or the ransomware activity to the same operator.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
An Enki blog post analyzing the joint South Korean advisory revealed three malware chains used in the watering-hole campaign, including multi-stage loaders, in-memory execution, encrypted payloads, and hidden storage in the registry and NTFS alternate data streams. It also detailed a COPPERHEDGE variant's persistence, anti-analysis techniques, and HTTP/HTTPS command-and-control via compromised South Korean web servers.
South Korean security and intelligence agencies issued a joint advisory warning that users could be infected by simply visiting compromised legitimate websites if vulnerable Korean financial-security software was installed. AhnLab described the related activity as "Operation Double Barrel" and reported strong technical overlaps between Lazarus espionage activity and the Gunra ransomware operation, while stopping short of saying both were the same actor.
The same campaign continued into 2026, with evidence of related attacks affecting 72 organizations and 15 legitimate websites used as watering holes. Security firms documented exploit chains involving malicious JavaScript, WebSocket abuse of local security software, shellcode execution, process injection, and in-memory payload loading.
Researchers observed a state-sponsored watering-hole and phishing campaign targeting visitors to trusted South Korean websites in the second half of 2025. The activity used compromised domestic sites to exploit local financial-security software and deliver the SIGNBT or COPPERHEDGE backdoors.
South Korean authorities and multiple security firms publicly disclosed the watering-hole campaign, its use of hacked Korean websites, and the SIGNBT/COPPERHEDGE malware cluster. Reporting also noted technical overlap with some Gunra ransomware intrusions but said the available analysis did not formally attribute the full campaign or Gunra incidents to Lazarus.
South Korea's KISA identified AnySign4PC versions 1.1.4.4 through 1.1.4.6 as vulnerable to a buffer overflow that enables remote code execution. The agency named version 1.1.5.0 as the fixed release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourceenki.co.kr
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourcebsky.app
Open sources2w.medium.com
Open sourcencsc.go.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean authorities and AhnLab disclosed **Operation Double Barrel**, a campaign that targeted Korean citizens and businesses from 2025 through the first half of 2026 by exploiting vulnerabilities in Korean financial security software. The activity used **watering hole** and **spear-phishing** attacks to direct victims to malicious URLs, after which attackers deployed backdoors including **Struggle** (also tracked as `SIGNBT 3.0`) and **Brandoor** (`COPPERHEDGE`). Legitimate Korean websites in media, education, healthcare, and manufacturing were abused as part of the watering hole infrastructure, and investigators said the pattern also raised possible **supply-chain** concerns tied to a shared website development and management company. The same software flaws were also used in separate intrusions that delivered **Gunra ransomware**, leading to file encryption and data exfiltration. A joint cybersecurity advisory issued by South Korea's **National Intelligence Service**, **National Police Agency**, **Korea Internet & Security Agency**, and **Financial Security Institute** said overlapping vulnerabilities, malware characteristics, SSH key fingerprints, and network infrastructure indicate possible limited collaboration or shared tooling between a state-sponsored threat actor and the Gunra ransomware group, although the relationship has not been confirmed definitively.
Aug 1, 2026
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026