Key Takeaways
- South Korean authorities and four security firms uncovered a state‑sponsored watering‑hole campaign that exploited a zero‑day flaw in the domestic AnySign4PC financial‑security software.
- Vulnerable AnySign4PC versions 1.1.4.4 – 1.1.4.6 allow silent remote code execution; version 1.1.5.0 patches the issue and users are advised to delete older installations.
- Attackers combined compromised legitimate websites with spear‑phishing lures (resumes, recruitment, investment material, surveys) to reach targets in news, healthcare, education, manufacturing and other sectors.
- The exploit chain used four PNG images to negotiate keys, check software version, deliver version‑specific shellcode via a WebSocket connection, and trigger a buffer overflow that injected malicious code into legitimate Microsoft processes.
- Depending on the outcome, the payload installed either the SIGNBT 3.0 (called “Struggle”) or COPPERHEDGE (called “Brandoor”) backdoor, granting remote command execution, file theft, credential harvesting, lateral movement and additional payload delivery.
- Forensic analysis revealed technical overlap with the Gunra ransomware campaign (shared filenames, SSH key fingerprint, C2 IP, anti‑forensic tactics), though the reports stop short of proving a single actor operated both.
- While AhnLab linked a separate March 2026 AnySign4PC watering‑hole attack to Lazarus in another report, the current advisory and Operation Double Barrel do not attribute the 2025‑2026 espionage campaign to Lazarus or connect Lazarus to Gunra.
- Defenders should hunt for abnormal DLL loading, encrypted registry blobs, in‑memory PE execution, unusual service creation, injection into SyncHost.exe or svchost.exe, and unexpected outbound SSH tunnels; preserving memory, command lines, registry values and network artefacts before termination aids analysis.
- Several compromised sites were tied to a common development and management firm, hinting at a possible supply‑chain vector, but no evidence shows the firm’s update infrastructure was itself compromised.
Overview of the State‑Sponsored Campaign
South Korean authorities, together with the National Intelligence Service, National Police Agency, Financial Security Institute and four private security firms (AhnLab, S2W, ENKI Whitehat, Plainbit), disclosed a coordinated state‑sponsored intrusion operation. The adversaries compromised trusted domestic websites and turned them into watering‑hole hosts. Visitors to these sites who were running vulnerable versions of the locally installed AnySign4PC financial‑security software suffered silent infections with either the SIGNBT or COPPERHEDGE backdoors, without any download prompt or user interaction.
Vulnerable AnySign4PC Software and Patch Guidance
The Korea Internet & Security Agency (KISA) identified AnySign4PC versions 1.1.4.4 through 1.1.4.6 as containing a buffer‑overflow flaw that permits remote code execution when a malicious web page is loaded. KISA’s June 1 2026 security notice lists version 1.1.5.0 as the fixed release and urges organisations to delete any vulnerable installations. AhnLab’s report references two undisclosed financial‑security products (labelled “A” and “I”) but does not publish their names, affected versions, or CVE identifiers, leaving some details opaque.
Attack Vectors: Watering Holes and Spear‑Phishing
The threat actors employed a dual approach. First, they injected malicious JavaScript into legitimate news, healthcare, education, manufacturing and smaller, poorly secured websites that their intended victims were likely to frequent. Second, they delivered spear‑phishing emails masquerading as resumes, recruitment offers, investment proposals and industry surveys. Both vectors aimed to drive targets to the compromised pages where the AnySign4PC exploit would fire automatically.
Technical Details of the Exploit Chain
ENKI Whitehat confirmed that the attackers exploited a zero‑day vulnerability in AnySign4PC. AhnLab’s Operation Double Barrel report describes a four‑stage PNG‑based exchange: the malicious page used four PNG images to negotiate encryption keys, query the installed AnySign4PC version, download version‑specific exploit code, and report success. Communication with the local security program occurred over a WebSocket channel, triggering a buffer overflow that executed shellcode. The shellcode was then injected into legitimate Microsoft processes such as SyncHost.exe or svchost.exe.
Malware Payloads: SIGNBT and COPPERHEDGE
Depending on the outcome of the initial exploit, the attackers deployed one of two backdoors. If the infection succeeded with the “Struggle” payload, the resulting malware corresponded to SIGNBT version 3.0; if the “Brandoor” payload was used, it matched the COPPERHEDGE backdoor. Both implants provided remote command execution, file system theft, internal reconnaissance, process injection, credential harvesting (including Mimikatz‑style tools), and the capability to download additional payloads. Persistence mechanisms varied, ranging from scheduled tasks that launched renamed SSH clients to in‑memory execution that left minimal artefacts on disk.
Connections to Gunra Ransomware
Forensic analysis uncovered notable overlap between the espionage chain and a March 2026 Gunra ransomware incident that used the same compromised healthcare website and the same vulnerability in the product AhnLab calls “financial‑security software A.” Both chains injected code into SyncHost.exe, reused the filenames net.tmp and inet.tmp, shared an identical SSH public‑key fingerprint (Qr1to32lQHxEu6phzNyrTZrU0iElrOfVWMBLnqoen24), leveraged the reverse‑tunnelling address 176.65.128[.]26, and distributed exploit scripts from the domain jshosting[.]me. Anti‑forensic tactics—renaming malicious files to random four‑character names before deletion and employing SDelete/CCleaner—were also common. AhnLab judged the evidence to indicate a likely technical link but could not confirm whether the same operator conducted both activities, noting possibilities such as shared tools, a common access broker, or coincidental reuse of infrastructure. Gunra operates as a ransomware‑as‑a‑service platform, having affected 32 organisations (including five South Korean firms) by March 9 2026.
Attribution Considerations and Lazarus Links
The joint government advisory and AhnLab’s Operation Double Barrel report describe the perpetrators only as a state‑sponsored threat group, without formally attributing the campaign to Lazarus. AhnLab did, however, attribute a separate March 2026 AnySign4PC watering‑hole attack to Lazarus in an April 2026 report, and Kaspersky has previously linked Lazarus to similar Tactics, Techniques and Procedures (TTPs) in its Operation SyncHole research. Those earlier findings show Lazarus’s historic use of AnySign4PC, SIGNBT, COPPERHEDGE and watering‑hole tactics, but they do not establish that Lazarus carried out the 2025‑2026 espionage operation described here or the Gunra ransomware activity.
Detection, Hunting Recommendations, and Supply‑Chain Notes
Defenders are advised to hunt for abnormal DLL loading by legitimate executables, encrypted data stored under service‑registry entries, in‑memory Portable Executable execution, unusual service creation, and injection into SyncHost.exe or svchost.exe. Unexpected outbound SSH tunnels should also raise alarms. ENKI observed that its Type 1 backdoor deletes its registry configuration and files after copying them into memory, making behavioural telemetry more reliable than static file indicators. Plainbit noted a persistence chain where a scheduled task named RuntimeBroker launched task.vbs, which executed a renamed SSH client as SearchHost.exe to establish a reverse tunnel. S2W recommends preserving process memory, command lines, registry values, DLL‑load events and network records before terminating or isolating systems. Several compromised sites were traced to a single development and management company, suggesting a possible supply‑chain vector, although no evidence indicates that the company’s update infrastructure or source code repository was itself breached.
Conclusion and Recommendations
The disclosed campaign highlights how trusted domestic web properties can be weaponised to exploit locally installed security software, enabling stealthy backdoor deployment with minimal user interaction. Prompt patching of AnySign4PC to version 1.1.5.0, rigorous removal of older builds, and continuous behavioural monitoring are essential to mitigate the threat. Organisations should also scrutinise third‑party website relationships and maintain robust phishing defences, as the attackers combined watering‑hole and spear‑phishing tactics to maximise reach. While technical overlaps with Gunra ransomware suggest possible tool sharing, attribution remains inconclusive, and defenders should focus on detecting the observed behaviours rather than relying solely on threat‑actor naming.