Loading story…
The official Korean Central News Agency (KCNA) website was used in a watering-hole attack that delivered a malicious ZIP archive disguised as an Adobe Flash Player update to Windows visitors. Systems without Flash Player 10 or newer were redirected to the fake installer, which deployed components including mscaps.exe and wtime32.dll, established persistence, injected into processes, stole system and user data, and communicated with multiple command-and-control servers.
The malware also spread beyond the initial compromise by infecting local files, network shares, and removable media, enabling broader propagation inside organizations. Telemetry linked infections primarily to China, South Korea, and Russia, with some detections involving DPRK-linked systems, while researchers said direct attribution to North Korea remained unproven because the KCNA site appeared to have an XSS weakness that could have been abused by another actor; the operation nevertheless showed several similarities to DarkHotel, including spoofed Flash installers, victim profiling, and multi-domain C2 infrastructure.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A record attributed to Hexspirit documenting the KCNA site's XSS weakness was posted on XSSed in April 2013. This public record is cited as supporting evidence that the site could have been compromised by a third party.
The KCNA website was reportedly vulnerable to cross-site scripting in early 2013, creating a plausible avenue for an external actor to place the malware bundle on the site. The analysis cites this as a reason not to assume DPRK developers directly ran the operation.
The malware components associated with the campaign, including mscaps.exe and wtime32.dll, were first detected in November 2012. This predates the first known appearance of the FlashPlayer malware bundle on the KCNA website.
The official KCNA website served a malicious ZIP archive disguised as a Flash Player update to some Windows visitors lacking Flash Player 10 or newer. The archive delivered executables using common Flash installer names and was described as the only known source of that malware bundle.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean authorities and security researchers disclosed a watering-hole campaign that compromised at least 15 legitimate domestic websites and abused vulnerable **AnySign4PC** software to install the **SIGNBT** and **COPPERHEDGE** backdoors on visitors' systems without user prompts. KISA said versions `1.1.4.4` through `1.1.4.6` were affected by a buffer-overflow flaw enabling remote code execution, with `1.1.5.0` identified as the patched release. Investigators said the activity ran from the second half of 2025 into 2026 and found related targeting across 72 organizations. Technical reporting from ENKI, AhnLab, and other researchers described exploit chains in which malicious JavaScript on hacked sites used WebSocket communication with local security software, executed shellcode, injected into legitimate Microsoft processes, stored encrypted data in the registry, and loaded payloads directly in memory. Separate analysis tied the malware cluster to **SIGNBT** and highlighted overlap with some **Gunra** ransomware intrusions, including shared infrastructure, filenames, exploit paths, and anti-forensic behavior, but the current advisory stopped short of formally attributing the broader campaign or the ransomware activity to the same operator.
Jul 31, 2026
Researchers tied a broader cyber-espionage operation to North Korea-linked actors after uncovering Android spyware variants known as **KevDroid** and a Windows backdoor dubbed **PubNubRAT** on infrastructure including `cgalim[.]com`. The Android malware stole contacts, SMS, account data, device information, screenshots, audio, video, and call recordings, and in some cases attempted rooting through `CVE-2015-3636`. Investigations also found trojanized Android apps themed around the **PyeongChang Winter Games** and **Bitcoin Ticker Widget**, while Windows infections used Korean-language lure documents exploiting `CVE-2017-11882` to download malware capable of file theft, command execution, process termination, and screenshot capture. The activity aligned with a longer-running campaign tracked as **Operation Rocket Man**, which targeted South Korean organizations, North Korea-related groups, defense entities, and individuals through spear phishing, watering-hole attacks, social-network phishing, torrent-delivered malware, malicious `HWP` and `DOC` files, Android APKs, and fake security software. Analysts linked campaigns from 2013 to 2018 through shared domains, malware code, PDB paths, metadata, and command-and-control patterns, including use of hacked Korean websites, cloud services such as **Dropbox**, **Yandex**, **pCloud**, and later **PubNub**, as well as exploits including `CVE-2018-4878` and `CVE-2017-8759`; false Chinese-language artifacts were assessed as likely deception.
Aug 15, 2026
North Korean threat actors expanded beyond traditional espionage into large-scale cryptocurrency theft and intrusion campaigns, with research presented at Black Hat identifying **1,640 organizations in 57 countries** touched by the activity and roughly **700 to 800** showing clearly malicious compromise. Investigators said some intrusions reached **root-level access** on servers and **AWS accounts**, while attackers also abused third-party contractors to reach government, healthcare, and private-sector victims. The activity was linked broadly to DPRK operations including **Lazarus Group**, which researchers said continues to pair social engineering with crypto theft and laundering to generate revenue believed to support sanctions evasion and state priorities. Separate reporting tied the shift to specific DPRK espionage clusters now targeting crypto users and firms directly. **Konni** was described as moving from South Korea-focused Windows espionage to a global **macOS** campaign using fake recruiter or document lures, **AppleScript**, `LaunchAgents`, **TCC** abuse, and payloads including **FileRATClient** and an **EggShell** variant. **Kimsuky** was reported to have operated a fake trading platform, **Tralert FX**, distributing a trojanized desktop app through direct download and the Microsoft Store before deploying a customized **Xeno RAT** via GitLab staging; researchers said that campaign affected more than **250 victim IPs across 28 countries**.
Aug 25, 2026