Adversary Intelligence — 2026-07-31

South Korean NIS Issues Joint Advisory After Lazarus-Linked Zero-Day Campaign Hits 72 Organizations Through Mandatory Banking Software

BLUFPyongyang's exploitation of mandatory banking software converts a compliance requirement into a nationwide attack surface, and the incomplete victim count suggests discovered compromises understate actual access.

South Korea's NIS, National Police Agency, KISA, and the Financial Security Institute issued a joint advisory with private firms AhnLab, S2W, ENKI Whitehat, and Plainbit on watering-hole attacks by state-backed hacking groups active since the second half of last year 12. The campaign compromised legitimate South Korean websites, including news and hospital sites, and exploited a zero-day vulnerability in the AnySign4PC financial-security software to install malware on visitors' systems without a prompt 23. ENKI Whitehat's technical analysis identified six malware samples across three infection-chain types, including a COPPERHEDGE backdoor variant, using ChaCha20 or AES-128 encryption and hiding payloads in the Windows registry and NTFS alternate data streams to evade detection 2. The advisory also flagged a parallel phishing vector using emails disguised as resumes or job offers, and the involved agencies are offering rewards for reports of related incidents 1.

Analysis
A joint state advisory turns a covert intrusion into public attribution, pressuring AnySign4PC's vendor toward an emergency patch and forcing organizations still running the software to treat visits to trusted domestic sites as a compromise vector. Six malware samples across three infection chains, including a COPPERHEDGE variant hiding payloads in the registry and NTFS alternate data streams, point to an operator investing well beyond opportunistic watering-hole tooling, though the samples could equally reflect several loosely affiliated crews sharing commodity loader techniques rather than one unified state operation. The parallel resume-themed phishing vector suggests the group is hedging against the browser-exploit channel being patched or blocked. Reporting rewards from NIS, KISA, and the Financial Security Institute signal the agencies still lack a complete tally of compromised sites and victims. Sourcing rests on a single primary technical breakdown corroborated independently by two outlets, yielding converging but moderate-reliability confirmation.

3 sources

South Korea warns of phishing emails and watering-hole attacks led by state-backed hackers - Digital Today
Threat Research Team Advisory (Joint Cybersecurity Advisory: Watering Hole Malware Analysis) - ENKI Whitehat
Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts - The Hacker News