The AnySign4PC Attack: Infecting South Koreans Without a Single Click

South Korean agencies — KISA, the National Intelligence Service, the National Police Agency and the Financial Security Institute — together with the firms AhnLab, S2W, ENKI Whitehat and Plainbit have published a report on a state-sponsored cyber-espionage operation. The attackers compromised trusted national websites and used them to target locally installed financial-security software.

Just Visiting a Page Was Enough

The key target was AnySign4PC, a program used for certificate-based electronic signatures. According to ENKI Whitehat, the attackers exploited a zero-day vulnerability, with activity observed from the second half of 2025 — even before KISA's June patch notice. KISA lists AnySign4PC versions 1.1.4.4 through 1.1.4.6 as vulnerable (a buffer overflow leading to remote code execution) and names 1.1.5.0 as the fixed version, recommending that vulnerable installations be removed.

The infection scheme required no user action. AhnLab's report “Operation Double Barrel” describes a chain in which four PNG images served to exchange keys, check the software version, deliver the exploit and report success. The malicious page communicated with the local security program over WebSocket and, through the buffer overflow, launched shellcode. The payload was injected into legitimate Microsoft processes, after which the Struggle backdoor (classified by AhnLab as SIGNBT 3.0) or Brandoor (COPPERHEDGE) was installed. The backdoors supported remote command execution, file theft, network reconnaissance and code injection.

Scale and Methods

AhnLab identified traces of related attacks in 72 organizations over the course of 2026 and found 15 legitimate sites used as “watering holes” — among them media, healthcare, education and industrial resources. In parallel, targeted phishing was sent out disguised as résumés, job invitations and industry surveys. To move laterally across the network the attackers used Mimikatz, privilege-escalation exploits, RDP and NLBrute, while covering their tracks by renaming files and using the SDelete and CCleaner utilities.

Overlap With Ransomware

The researchers found technical matches with an intrusion that ended in the Gunra ransomware: the same SSH key fingerprint, the same reverse-tunnel address, the domain jshosting[.]me and the file names net.tmp and inet.tmp. AhnLab stresses that this points to a shared or reused access path but does not prove that a single operator is behind both operations.

Cautious Attribution

The official report names the culprit only as a “state-sponsored group.” In a separate publication in April, however, AhnLab attributed a March attack via AnySign4PC to the Lazarus group, and Kaspersky had earlier documented that group's use of similar techniques in Operation SyncHole. Formally, though, the campaign is not linked to Lazarus.

Notably, there is no public CVE for the AnySign4PC vulnerability: as of July 30, 2026, the databases contained only the unrelated CVE-2020-7882. Experts advise relying not on static indicators but on behavioral telemetry — suspicious DLL loading by legitimate processes, injection into svchost.exe and unexpected outbound SSH tunnels.

Source: The Hacker News