South Korea warns of nation-state actors using phishing and compromised websites

As reported by Security Affairs, South Korea has issued a joint advisory from its National Intelligence Service, National Police Agency, Korea Internet & Security Agency, and Financial Security Institute, warning of a state-backed hacking group actively targeting citizens and businesses. The advisory highlights two primary attack vectors: phishing emails and watering hole attacks, emphasizing the minimal effort required from victims to be compromised.

The phishing attacks involve disguised job applicants sending resumes with malicious links or impersonating recruiters with password-protected ZIP files containing malware. More concerning are the watering hole attacks, where threat actors compromise legitimate websites, including news portals and hospital sites, turning them into infection launch points. Visiting these sites alone can trigger an infection by exploiting unpatched vulnerabilities in existing security software without user interaction.

This aligns with AhnLab's "Operation Double Barrel," which documented similar techniques across 15 compromised Korean websites between 2025 and mid-2026, targeting media, hospitals, and manufacturers. Attackers exploited flaws in Korean financial security software to inject backdoors. Once infected, systems risk credential theft, data exfiltration (documents, photos), and lateral movement within networks. For businesses, stolen source code and customer data are used for extortion.

Recommended mitigations include updating all security software, enabling two-factor authentication, avoiding saving passwords in browsers, and verifying senders before opening links or attachments. Organizations are advised to implement network segmentation, mandatory multi-factor authentication, regular phishing training, and prompt reporting of suspicious activity.

Source: Security Affairs