Now Hacked
EN
Malware

Lazarus malware attacks hit at least 3 South Korean companies

First reported · Last reported · 14 related reports

Signs have emerged that at least three South Korean companies in software, construction and wired communications equipment were hit by the North Korean hacking group Lazarus's Operation Flash Hole attack. The attack used lures through fake resume and portfolio sites, abuse of the financial security program CrossWeb EX, and malware applying post-quantum cryptography. Web addresses of the Korean Society of Obstetrics and Gynecology and South Korean media outlets were also found on a list of the malware's command-and-control communication points, and the society informed a security firm and began verification. The actual extent of the breach at those servers and whether personal data leaked have not been confirmed.

Key facts

Affected organization
Being confirmed
Incident type
Malware
Occurred / detected
Not confirmed
Scale of damage
At least three South Korean companies in software, construction and wired communications equipment
Cause / method
Malware intrusion using lures through fake resume and portfolio sites and abuse of CrossWeb EX
Location
South Korea

Timeline

  1. Lazarus's Operation Flash Hole attack on at least three South Korean organizations, abusing phishing sites and financial security software, was reported.
  2. Signs of CrossWeb EX abuse and an analysis of malware intrusion through fake resume and portfolio sites were released, and the specific way the program was abused has not been determined.
  3. It was reported that web addresses of the Korean Society of Obstetrics and Gynecology and South Korean media outlets were on a list of the malware's command-and-control communication points, and the society informed a security firm and began verification.

14 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.