Lazarus Group Abused Trusted Security Tools to Spy on South Korean Organizations

En bref

• North Korea-linked Lazarus Group is blamed for espionage intrusions at South Korean entities
• At least three organizations spanning three different sectors were hit
• Attackers turned trusted security software into a channel for delivering malware
• One target operates in the post-quantum encryption space
• No CVE was assigned; the campaign relied on abuse of legitimate tooling rather than a software flaw

A new espionage operation has been tied to the North Korea-associated Lazarus Group by Kaspersky researchers collaborating with a South Korean security firm, with observed activity spanning July 2025 to October 2026. The operation reached a minimum of three victim organizations, spread across three distinct industry sectors, all located in South Korea.

The defining characteristic of this campaign is that the intruders did not need a freshly discovered vulnerability. Instead, they turned everyday security products into a delivery mechanism, leveraging the implicit trust defenders place in protective software to move malware into victim environments. That approach makes detection harder, because traffic and tooling tied to antivirus or endpoint agents rarely raises alarms on its own.

Among those caught in the crosshairs is an entity working on post-quantum encryption, a detail that raises the stakes considerably. Compromise of organizations developing next-generation cryptographic protections carries long-term implications: stolen design data, implementation details, or intellectual property can shape an adversary's planning for years, well beyond the lifetime of any single intrusion.

The campaign is intelligence-gathering first and foremost, though malware implantation gives the intruders a persistent foothold they can re-use. Because no CVE is attached, there is no patch that closes this door; defenders must instead scrutinize how trusted software behaves in their environments.

For K-12 and public-sector defenders in New Brunswick, the practical lesson is that trusted-by-designation is not the same as trusted-in-fact. Attackers tied to nation-states are increasingly content to borrow an organization's own defensive stack. Watch for unusual child processes spawned by security agents, unexpected outbound connections from endpoint protection services, and supply-chain relationships with security vendors that lack independent verification. Organizations with cryptography research or long-lived sensitive data should treat this as a prompt to review logging coverage and identity boundaries.

À faire maintenant

1. Audit how security software is installed, updated, and permitted to execute, and restrict who can modify those components
2. Hunt for anomalous process trees where endpoint or antivirus services spawn unexpected child processes
3. Baseline outbound network traffic from security agents and alert on destinations outside known vendor infrastructure
4. Enforce hardware-backed MFA and least privilege on accounts tied to security tool administration
5. Segment systems handling cryptographic research or long-lived sensitive data from general-purpose networks
6. Forward endpoint and security-product logs to a central SIEM with retention sufficient for retrospective hunting
7. Brief staff on social engineering that masquerades as security tooling updates or vendor support

Source originale

The Hacker News