Now Hacked
EN-GB
Malware

Lazarus malware attacks hit at least 3 South Korean companies

First reported · Last reported · 14 related reports

Signs have emerged that at least three South Korean companies in software, construction and wired communications equipment were hit by the North Korean hacking group Lazarus's Operation Flash Hole attack. The attack used lures through fake CV and portfolio sites, abuse of the financial security program CrossWeb EX, and malware applying post-quantum cryptography. Web addresses of the Korean Society of Obstetrics and Gynecology and South Korean media outlets were also found on a list of the malware's command-and-control communication points, and the society informed a security firm and began verification. The actual extent of the breach at those servers and whether personal data leaked have not been confirmed.

Key facts

Affected organisation
Being confirmed
Incident type
Malware
Occurred / detected
Not confirmed
Scale of damage
At least three South Korean companies in software, construction and wired communications equipment
Cause / method
Malware intrusion using lures through fake CV and portfolio sites and abuse of CrossWeb EX
Location
South Korea

Timeline

  1. Lazarus's Operation Flash Hole attack on at least three South Korean organisations, abusing phishing sites and financial security software, was reported.
  2. Signs of CrossWeb EX abuse and an analysis of malware intrusion through fake CV and portfolio sites were released, and the specific way the program was abused has not been determined.
  3. It was reported that web addresses of the Korean Society of Obstetrics and Gynecology and South Korean media outlets were on a list of the malware's command-and-control communication points, and the society informed a security firm and began verification.

14 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.