source_3863.pdf (4 MB)

A state-backed group exploited vulnerabilities in South Korean financial security software through watering-hole and spear-phishing attacks, installing Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) backdoors. A separate intrusion path used the same vulnerabilities and overlapping malware, SSH key fingerprints, download and reverse-tunneling infrastructure before deploying Gunra ransomware, encrypting files, and stealing sensitive data. ASEC assesses that the actors may have shared techniques, tools, or infrastructure, or cooperated on a limited basis, but says the available evidence does not establish their relationship conclusively. The report calls the linked activity Operation Double Barrel and also examines possible supply-chain compromise through a common website development and management provider.