SOUTH KOREAN COMPANIES TARGETED BY LAZARUS VIA WATERING HOLE ATTACKS, ZERO-DAYS

Summary from the TLDR InfoSec newsletter

North Korean APT Lazarus targeted six South Korean organizations in finance, IT, semiconductors, software, and telecommunications through Operation SyncHole. They employed watering hole attacks and exploited zero-day vulnerabilities in security software, targeting Cross EX and Innorix Agent for online banking and government sites. The attack utilized malware such as ThreatNeedle, wAgent, SignBT, and CopperHedge for reconnaissance and access maintenance, while Lazarus further developed tools to evade detection.