North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn

1. Executive summary

South Korean intelligence agencies and AhnLab have published research detailing "Operation Double Barrel," a campaign in which North Korea's Lazarus Group (MITRE G0032) and the Gunra ransomware operation ran parallel intrusions against South Korean targets from 2025 through H1 2026. Both actors exploited the same vulnerabilities in mandatory Korean financial security software, used identical malware filenames, privilege escalation tools, C2 infrastructure, and SSH key fingerprints. Lazarus deployed espionage backdoors across at least 72 organisations (government, cryptocurrency exchanges, IT service providers), while Gunra used the same access for file encryption and extortion. The tool-sharing relationship — whether collaboration, shared infrastructure, or access brokering — signals an elevated risk for EMEA financial services with South Korean operations, supply-chain dependencies, or exposure to Korean-mandated security software.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 28: ICT third-party risk — general principles	Attackers compromised a Korean website development company and pivoted to 15 client watering-hole sites via its management system — a third-party provider whose compromise cascaded to downstream clients.	Financial entities using third-party web hosting or development firms should assess whether their providers' management systems could similarly become a pivot point for supply-chain compromise.
DORA Art. 18: classification of ICT-related incidents and cyber threats	A single vulnerability set in mandatory financial security software was exploited by both a state-sponsored espionage actor and a ransomware operation, creating dual espionage-and-extortion impact potential.	Incident classification processes must account for scenarios where the same initial access vector yields both data exfiltration and ransomware impact, potentially qualifying as major under multiple categories.

3. Technical analysis & attack chain

Attribution caveat: Lazarus Group is confirmed as MITRE G0032. AhnLab assessed the overlap between Lazarus and Gunra as having "a high likelihood of technical linkage" but stopped short of definitive attribution to the same actor. The relationship could indicate collaboration, shared infrastructure, or access brokering. This advisory treats the Lazarus attribution as confirmed and the Lazarus-Gunra operational link as unconfirmed but technically corroborated by AhnLab's single-source reporting.

Attack chain (confirmed steps from AhnLab reporting)

Initial access — watering-hole attacks. Attackers compromised 15 legitimate Korean websites across multiple industries. Visitors were redirected to attacker-controlled infrastructure that triggered vulnerabilities in Korean financial security software (effectively mandatory for Korean banking and government services) and injected malicious code into legitimate Microsoft processes. The compromised sites were all managed by the same Korean website development company; attackers compromised the hosting provider first, then expanded to client sites through the development company's management system rather than targeting each site individually.
Initial access — spearphishing. Parallel spearphishing campaigns were also run. One targeted a Korean defense company using emails disguised as a survey about GaN semiconductors. AhnLab assessed that AI was likely used to generate some lure pages.
Exploitation. Both Lazarus and Gunra exploited the same vulnerabilities in the mandatory Korean financial security software products. Specific CVEs, product names, and versions are not provided in the source material.
Execution and persistence. Both groups used identical malware filenames and execution arguments. Malware was injected into legitimate Microsoft processes (process hollowing or similar technique — specific process names not provided).
Privilege escalation. Both groups used the same privilege escalation tools. Specific tool names are not provided in the source material.
Command and control. Both groups used the same C2 servers and the same SSH key fingerprint — a cryptographic identifier functioning as a unique digital signature. Specific C2 domains, IPs, and the SSH fingerprint value are not provided in the source material.
Impact — Lazarus track. Espionage backdoors installed in at least 72 organisations in 2026 alone, including government agencies, cryptocurrency exchanges, and IT service providers.
Impact — Gunra track. File encryption, data theft, and extortion demands using the same access path and tooling.
Defence evasion. Both groups deleted malware using the same technique: renaming files to random four-character strings before wiping them.

Single-source caveat: The entirety of the technical detail above is sourced from AhnLab's reporting as relayed by The Record. No second source corroborates the specific tool overlaps, the 72-victim count, or the SSH fingerprint match. Verify before enforcement.

4. Mitigation & containment

P1 — within 24 hours

Identify any EMEA operations running Korean financial security software (mandatory for Korean banking/government services). Inventory instances and ensure they are fully patched. The advisory from South Korean agencies specifically warns that infection can occur via drive-by compromise of legitimate websites when outdated security software is installed.
Review web filtering and DNS logs for connections to Korean domains managed by third-party development companies, particularly if staff with Korea-related business functions visited Korean sites in the past 90 days.
Brief SOC/IR teams on the dual-impact scenario: a single intrusion vector yielding both espionage backdoors and ransomware deployment. Adjust IR playbooks to hunt for both outcomes when investigating any suspected Korean-software exploitation.

P2 — within 72 hours

Audit third-party web hosting and development providers for exposure to the supply-chain compromise pattern described (attacker compromises hosting provider → pivots via management system to client sites). Request attestation from any Korean web development vendors that their management systems have not been compromised.
Deploy EDR detection rules targeting the observed defence-evasion behaviour: files renamed to random four-character strings immediately prior to deletion. (See §6 for detection logic.)
Review SSH key fingerprints on any infrastructure touching Korean networks or partners. Flag any unexpected or unauthorised SSH keys for investigation.

P3 — within 7 days

Enhance spearphishing controls for staff in defence, semiconductor, or Korea-facing roles. The GaN semiconductor survey lure and AI-generated lure pages indicate socially engineered targeting of sector-specific personnel.
Assess whether any EMEA financial services entities use the affected Korean financial security software in branch operations, correspondent banking, or Korean subsidiary infrastructure. Where identified, apply network segmentation to limit blast radius.
Review broader North Korean ransomware entanglement risk: separate reporting links DPRK actors to Play, Qilin, and Medusa ransomware operations. Ensure ransomware readiness covers scenarios where initial access is brokered from state-sponsored intrusion sets.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, SSH fingerprints, filenames) are provided in the source material. AhnLab's technical report likely contains these, but they were not included in the available reporting.

Behavioural indicators

Behaviour	Where to observe	Confidence
Files renamed to random four-character strings before deletion	EDR file operation logs, filesystem audit logs	Medium — single-sourced (AhnLab)
Identical malware filenames and execution arguments used across separate espionage and ransomware campaigns	EDR process logs, sandbox reports	Medium — single-sourced (AhnLab)
Same SSH key fingerprint across distinct threat actor operations	SSH server logs, endpoint SSH client logs, network security monitoring	Medium — single-sourced (AhnLab)
Shared C2 infrastructure between espionage backdoors and ransomware operations	Network firewall logs, DNS logs, proxy logs	Medium — single-sourced (AhnLab)
Malicious code injected into legitimate Microsoft processes	EDR process hollowing detection, memory scanning	Medium — single-sourced (AhnLab)
Watering-hole redirects from compromised Korean legitimate websites to attacker infrastructure	Web proxy logs, DNS logs, browser security logs	Medium — single-sourced (AhnLab)
Spearphishing emails with GaN semiconductor survey lures, likely AI-generated lure pages	Email security gateway, mail logs	Medium — single-sourced (AhnLab)

6. Detection

rule Operation_Double_Barrel_Malware_Wipe_Behaviour {
  meta:
    author = "Adverse Trace"
    date = "2026-07-30"
    reference = "https://therecord.media/north-korea-hackers-ransomware"
    description = "Detects files matching the random four-character string rename pattern used by Lazarus and Gunra for malware deletion in Operation Double Barrel. This is a behavioural heuristic — tune for your environment."
  condition:
    // This rule is a placeholder for EDR-based behavioural detection.
    // The source material does not provide specific file artefacts, strings, or hashes.
    // Implement as an EDR query: file rename to pattern ^[a-zA-Z0-9]{4}$ followed by deletion within short time window.
    false
}

Note: The source material describes behaviours (four-character random rename before wipe, process injection into Microsoft processes, shared SSH fingerprints) but does not provide specific strings, filenames, registry keys, or hashes. The YARA rule above cannot be operationalised without the underlying AhnLab technical report. EDR behavioural detection is the appropriate approach:

Process injection detection: Enable EDR rules for code injection into legitimate Microsoft processes (e.g., rundll32.exe, svchost.exe, explorer.exe — standard hollowing targets).
File rename-then-delete pattern: Create an EDR detection rule for any file renamed to a string matching ^[a-zA-Z0-9]{4}\.(exe|dll|tmp|dat)$ followed by deletion within 60 seconds.
SSH key fingerprint correlation: Correlate SSH key fingerprints across endpoint and server logs; alert on any fingerprint appearing on systems associated with different user groups or business functions.

Insufficient atomic indicators to author a Sigma rule from the source material.

Threat actor context

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

7. Sources

The Record (2026-07-30). "North Korea's Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn." https://therecord.media/north-korea-hackers-ransomware

8. Adverse Trace position

Severity: High. The confirmed sharing of tooling, infrastructure, and operational tradecraft between a state-sponsored espionage actor (Lazarus / MITRE G0032) and a ransomware operation (Gunra) represents a meaningful escalation in the DPRK-ransomware nexus. For EMEA financial services, the direct risk is concentrated in entities with Korean operations, subsidiaries, or dependencies on Korean-mandated security software — but the broader pattern (North Korean actors embedding within Play, Qilin, and Medusa per separate reporting from Palo Alto Networks, Microsoft, and Symantec) indicates an industry-wide trend of DPRK access brokering and ransomware affiliation. The single-sourced nature of the AhnLab reporting and the absence of published IOCs limits immediate enforcement action. We will monitor for the AhnLab technical report and the South Korean joint advisory to extract atomic indicators, and we will update clients if C2 infrastructure, SSH fingerprints, or malware samples become available. Clients with Korean operations should treat this as an active threat and prioritise the P1 actions in §4.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.