Adversary Intelligence — 2026-07-31

North Korea Lazarus Group Sharing Attack Tools With Ransomware Criminals, South Korean Agencies Warn

BLUFShared infrastructure between Pyongyang's state hackers and criminal ransomware operators complicates attribution for defenders and almost certainly will not be formally confirmed as unified command before late October.

A joint advisory from South Korea's NIS, National Police Agency, KISA, and the Financial Security Institute, published alongside an AhnLab technical report Wednesday, states a state-sponsored threat group exploited a buffer-overflow vulnerability in AnySign4PC (versions 1.1.4.4-1.1.4.6, patched in 1.1.5.0), mandatory financial security software, via a WebSocket connection that triggered backdoor installation without any user prompt or download, from 2025 into the first half of 2026 12. The joint advisory and AhnLab's report do not formally name the actor as Lazarus; that attribution stems from AhnLab's separate April 2026 report tying a March 2026 AnySign4PC watering-hole attack to the group and from outside researchers' tracking of the SIGNBT/COPPERHEDGE toolset 23. AhnLab documented 15 compromised South Korean websites across media, education, healthcare, and manufacturing sectors used in watering-hole attacks alongside spear-phishing, and confirmed related activity at 72 organizations 3. The campaign delivered backdoors AhnLab designated Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) 23. Separately, AhnLab found a March incident involving Gunra ransomware operators exploiting the same software vulnerability against a South Korean healthcare organization, sharing an identical SSH key fingerprint, a reverse-tunneling address, a file distribution domain, and process-injection technique with the state-sponsored intrusions, though AhnLab stated the evidence shows "a likely technical link" without confirming common operator control 234.

Analysis
The AnySign4PC flaw sat unpatched for at least six months, so any actor who obtained it before KISA's fix, not just the two campaigns AhnLab caught, could still hold usable access. Shared infrastructure across the state-linked intrusions and the Gunra ransomware incident: an identical SSH key fingerprint, reverse-tunneling address, and distribution domain points to a shared technical resource rather than a single command structure, though this is a low-confidence read given AhnLab's own hedged language and the lack of corroboration beyond its single advisory. The overlap could instead reflect a common access broker or leaked toolset rather than coordination between Lazarus and Gunra. Reporting rests entirely on AhnLab as sole primary source, with other outlets merely repackaging its findings. Enterprises detecting Struggle or Brandoor indicators cannot treat those signatures alone as confirmation of state sponsorship.

4 sources