AhnLab observed the Lazarus group exploiting an AnySign4PC vulnerability in a watering-hole attack against the financial-sector ecosystem, enabling remote code execution. Multiple watering-hole distribution sites remained in use, indicating continuing exposure beyond a single compromised location. The broader March 2026 monitoring also identified Korean-language phishing attachments, HTML and JavaScript delivery methods, financial-sector account compromise, and malware ranging from web shells and backdoors to information stealers and cryptocurrency miners.