Lazarus Group Weaponizes Mandatory South Korean Banking Software AnySign4PC in Zero-Day Watering-Hole Campaign; 72 Orgs Compromised

KISA and AhnLab disclosed a state-sponsored watering-hole campaign exploiting a zero-day buffer-overflow in AnySign4PC (versions 1.1.4.4–1.1.4.6), mandatory certificate-based signing software required by South Korean banking and government portals, enabling silent backdoor installation with no user interaction. Compromised pages on 15 legitimate South Korean news and healthcare websites delivered SIGNBT (v3.0/'Struggle') and COPPERHEDGE ('Brandoor') backdoors, with AhnLab attributing a March 2026 cluster to Lazarus under the RGB. Evidence of related attacks spans 72 organizations throughout 2026, with some intrusion chains overlapping with Gunra ransomware deployments sharing identical initial-access TTPs, SSH key fingerprints, and C2 infrastructure.

Compromised pages on 15 legitimate South Korean news and healthcare websites delivered SIGNBT (v3.0/'Struggle') and COPPERHEDGE ('Brandoor') backdoors, with AhnLab attributing a March 2026 cluster to Lazarus under the RGB.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.