South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors.
A compromised page could infect a system running a vulnerable AnySign4PC version without a prompt or user-initiated download. The Korea Internet & Security Agency (KISA) says AnySign4PC versions 1.1.4.4 through 1.1.4.6 are affected and lists version 1.1.5.0 as the fixed release. It recommends deleting vulnerable installations.
AhnLab refers to two exploited products only as financial-security software A and I. Its report does not disclose their identities, affected or fixed versions, or vulnerability identifiers.
AhnLab said it identified evidence of related attacks at 72 organizations in 2026. The company also found 15 legitimate websites used as watering holes. Its investigation also found overlap with attacks that ended with Gunra ransomware.
The shared evidence included the same initial-access vulnerability, malware filenames and execution patterns, SSH key fingerprint, and network infrastructure. AhnLab said the evidence does not establish that one actor conducted both operations. The report does not say what evidence put an organization in the count, so 72 is not a tally of equally confirmed full compromises. The advisory does not name the state-sponsored group.
A Page Visit Was Enough
The joint advisory was issued by KISA, the National Intelligence Service, National Police Agency, and Financial Security Institute, based on analysis conducted with AhnLab, S2W, ENKI Whitehat, and Plainbit.
KISA said state-sponsored phishing and watering-hole attacks of this kind continue to be identified. The public reports do not say whether attackers continued exploiting AnySign4PC after version 1.1.5.0 became available.
The attackers sent spear-phishing messages disguised as resumes, recruitment approaches, investment material, and industry surveys. They also compromised news, healthcare, education, manufacturing, and smaller, poorly secured websites that their intended victims were likely to visit.
ENKI Whitehat identified AnySign4PC, software used for certificate-based electronic signatures, as one of the vulnerable products and said the attackers had exploited a zero-day flaw. ENKI observed the activity from the second half of 2025, before KISA published its June 2026 patch notice.
AhnLab’s Operation Double Barrel report describes an exploit chain that used four PNG images to exchange keys, check the installed software version, deliver version-specific exploit code, and report whether execution succeeded. The malicious page communicated with the local security program over WebSocket and triggered a buffer overflow to execute shellcode.
The payload was then injected into legitimate Microsoft processes. Depending on the intrusion, the attackers installed Struggle, which AhnLab maps to SIGNBT 3.0, or Brandoor, its name for the COPPERHEDGE backdoor. The malware supported remote command execution, file theft, internal reconnaissance, process injection, and delivery of additional payloads.
Plainbit independently reconstructed one of the watering-hole incidents in its forensic report. Attackers mapped the victim’s internet-facing systems, compromised its website, installed a webshell, and inserted JavaScript into a legitimate news-article page. When a target visited it, the vulnerable security program generated an error and created a malicious DLL without a download prompt or other user interaction.
The resulting backdoor decrypted later stages in memory, injected code into svchost.exe, and read command-and-control information from the Windows registry. The attackers subsequently used privilege-escalation exploits, Mimikatz and other credential tools, Remote Desktop Protocol connections, and NLBrute to move through the network.
S2W’s analysis of three malware clusters found a recurring pattern of DLL side-loading, encrypted registry blobs, and in-memory Portable Executable loading. Two clusters deployed SIGNBT versions 0.0.1 and 1.2, while a third loader decrypted an external payload that researchers could not recover.
The Gunra Trail
A March 2026 Gunra ransomware intrusion used the same compromised healthcare website and the same vulnerability in the product AhnLab calls financial-security software A. Both the state-sponsored and ransomware chains then injected code into SyncHost.exe. AhnLab does not identify software A, so the report does not establish that the Gunra-linked vulnerability was AnySign4PC.
AhnLab also found that both operations used the filenames net.tmp and inet.tmp. The inet.tmp argument was identical, while the net.tmp arguments followed a similar GUID format. Both operations used the same SSH public-key fingerprint Qr1to32lQHxEu6phzNyrTZrU0iElrOfVWMBLnqoen24. They also used the same reverse-tunnelling address 176.65.128[.]26. The domain jshosting[.]me was used to distribute exploit scripts in both sets of attacks.
The attackers also followed the same anti-forensic procedure, renaming malicious files to random four-character names before deleting them. Plainbit observed additional evidence destruction using SDelete and CCleaner.
AhnLab assessed that the evidence shows a likely technical link but said it could not determine the relationship between the operators. The company listed several possible explanations, including limited collaboration, shared tools or infrastructure, use of a common access broker, or access to the same operational resources.
The overlaps show a shared or reused access path from the compromised website through host execution and supporting infrastructure. They do not show that the same operator controlled both attacks.
Gunra operates as a ransomware-as-a-service program, according to separate research from S2W.
The firm said the operation had affected 32 companies as of March 9, 2026, including five South Korean businesses, and had moved from Conti-derived ransomware to its own Windows and Linux builds.
Attribution Stops Short of Lazarus
The current government advisory and Operation Double Barrel report describe the espionage-focused operator only as a state-sponsored threat group. Neither document formally attributes the complete 2025 to 2026 campaign to Lazarus, and neither connects Lazarus to Gunra.
AhnLab did, however, attribute a March 2026 AnySign4PC watering-hole attack to Lazarus in a separate report published in April. Kaspersky also documented Lazarus using watering holes, South Korean security software, SIGNBT, and COPPERHEDGE during the earlier Operation SyncHole.
Those reports document prior Lazarus use of AnySign4PC, SIGNBT, COPPERHEDGE, and watering-hole exploitation. They do not attribute Operation Double Barrel or the Gunra intrusions to Lazarus.
Patch the Software, Hunt the Behaviour
KISA’s June 1 security notice identifies AnySign4PC versions 1.1.4.4 through 1.1.4.6 as vulnerable to a buffer overflow that permits remote code execution. It lists version 1.1.5.0 as the fixed release and recommends deleting vulnerable installations.
The reports recommend hunting for suspicious DLL loading by legitimate executables, encrypted data stored under service-registry entries, in-memory PE execution, unusual service creation, injection into SyncHost.exe or svchost.exe, and unexpected outbound SSH tunnels.
ENKI found that its Type 1 backdoor deleted its registry configuration, loader, and backdoor files after copying them into memory when running in modes 1, 2, 4, or 5 with self-protection enabled. Once initialised, the files were absent from disk until a clean shutdown wrote them back, and the restored loader had a different hash. That makes behavioural telemetry more useful than a stable-file indicator.
Plainbit observed one persistence chain in which a scheduled task named RuntimeBroker launched task.vbs, which then ran a renamed SSH client as SearchHost.exe to establish a reverse tunnel. S2W advises preserving process memory, command lines, registry values, DLL-load events, and network records before terminating processes or isolating systems.
AhnLab also found that several compromised websites were connected to the same development and management company, which it described as a possible supply-chain route. The available evidence does not establish that the company’s source code, software-update process, or central management platform was compromised.
KISA’s June 1 notice does not list a CVE identifier for the AnySign4PC flaw. As of July 30, 2026, The Hacker News found only CVE-2020-7882 in public CVE Program and NVD searches for AnySign4PC, an unrelated directory-traversal vulnerability affecting older versions. That result does not rule out a reserved, unpublished, or differently described identifier. AhnLab’s software A and I remain unidentified in its report, which also does not disclose their affected or fixed versions.
