Compromised Korean Websites Become Distribution Point for AnySign4PC Backdoor Attacks

South Korean cybersecurity authorities, together with several security vendors, have uncovered a sophisticated state-sponsored cyber-espionage campaign that leveraged compromised trusted websites to infect visitors with advanced backdoors. The operation targeted users through legitimate domestic websites and abused vulnerabilities in locally installed financial-security software, allowing malware deployment without requiring downloads, prompts, or user approval.

The campaign ultimately delivered two powerful backdoors known as SIGNBT and COPPERHEDGE, giving attackers persistent access to compromised systems.

Vulnerable Software Enabled Silent Compromise

Investigators identified a critical weakness in AnySign4PC, a widely used certificate-based electronic signature solution in South Korea. According to the Korea Internet & Security Agency (KISA), versions 1.1.4.4 through 1.1.4.6 are vulnerable, while version 1.1.5.0 contains the necessary security fixes.

Authorities have advised organizations and users to remove vulnerable installations immediately and upgrade to patched versions.

One of the most alarming aspects of the campaign was that simply visiting a compromised webpage could trigger exploitation if the vulnerable software was present. Victims did not need to click links, download files, or approve security prompts for the attack to succeed.

Large-Scale Targeting Across Multiple Sectors

Security researchers discovered evidence of attacks affecting dozens of organizations throughout 2026. The campaign leveraged at least 15 legitimate websites that had been secretly compromised and turned into watering-hole attack platforms.

The targeted websites spanned multiple industries, including:

• News and media outlets
• Healthcare organizations
• Educational institutions
• Manufacturing companies
• Smaller businesses with weaker security controls

The attackers carefully selected websites likely to be visited by their intended victims, maximizing the effectiveness of the campaign.

In addition to website compromises, the threat actors distributed highly targeted spear-phishing messages disguised as:

• Job applications and resumes
• Recruitment opportunities
• Investment proposals
• Industry surveys
• Business-related documents

How the Exploitation Chain Worked

Researchers found that the threat actors employed a sophisticated multi-stage exploitation process.

When a target visited a compromised website, malicious JavaScript embedded within legitimate web pages interacted with vulnerable security software installed on the victim's computer. The attack leveraged WebSocket communications to communicate directly with the locally installed application.

The exploit chain used multiple PNG files as covert delivery mechanisms for:

• Key exchange data
• Software version checks
• Version-specific exploit code
• Execution verification

By exploiting a buffer overflow vulnerability in the software, attackers were able to execute shellcode directly on target machines.

Once execution was achieved, the malicious payload was injected into trusted Microsoft Windows processes, helping it evade detection by security tools.

Deployment of SIGNBT and COPPERHEDGE Backdoors

Following successful exploitation, attackers deployed one of two advanced malware families:

SIGNBT

SIGNBT provided extensive remote-access capabilities, including:

• Remote command execution
• File theft
• System reconnaissance
• Additional malware deployment
• Network discovery

COPPERHEDGE

COPPERHEDGE offered similar espionage functions and was designed to maintain persistent access to infected systems while facilitating lateral movement throughout victim networks.

Researchers observed both malware families utilizing advanced techniques such as:

• Process injection
• Memory-only execution
• DLL side-loading
• Encrypted registry storage
• In-memory payload decryption

These tactics significantly reduced forensic evidence left on compromised systems.

Website Compromise and Silent Malware Installation

In one investigated intrusion, attackers first mapped an organization's internet-facing infrastructure. After identifying weaknesses, they compromised the target's website and installed a web shell.

Malicious JavaScript was then inserted into a legitimate news article page visited by targeted users.

When victims accessed the page, the vulnerable security software automatically generated an error condition that attackers exploited to create a malicious DLL file on the local machine.

Remarkably, this process occurred:

• Without download prompts
• Without browser warnings
• Without security confirmations
• Without visible user interaction

The resulting malware eventually injected code into svchost.exe, one of Windows' core system processes, and retrieved command-and-control information from the Windows Registry.

Attackers Expanded Their Access After Initial Infection

After establishing persistence, investigators observed attackers using additional tools and techniques to expand access within victim environments.

These included:

• Privilege escalation exploits
• Mimikatz credential theft tools
• Remote Desktop Protocol (RDP)
• Password-cracking utilities
• Internal network reconnaissance

The attackers systematically harvested credentials and moved laterally across networks to access additional systems and sensitive information.

Links to Earlier Ransomware Activity

Researchers also identified notable overlaps between this espionage campaign and previous Gunra ransomware incidents.

Forensic similarities included:

• Shared exploitation pathways
• Identical malware filenames
• Similar execution patterns
• Common SSH key fingerprints
• Shared network infrastructure
• Matching reverse-tunneling addresses

Both operations also employed similar anti-forensic techniques, including automatically renaming malicious files before deleting them to hinder investigations.

Despite these similarities, researchers emphasized that the available evidence does not conclusively prove that the same threat actor conducted both operations. Instead, the overlap suggests possible shared tools, infrastructure, access brokers, or operational resources.

Attribution Remains Cautious

Government agencies and security vendors have described the operation broadly as a state-sponsored cyber-espionage campaign.

While some previous attacks involving AnySign4PC, SIGNBT, and COPPERHEDGE have been associated with the Lazarus Group, researchers stopped short of formally attributing this specific campaign to Lazarus.

Security analysts highlighted that the tactics, malware families, and watering-hole techniques closely resemble activities previously linked to North Korean threat actors. However, definitive attribution remains unconfirmed.

Detection and Defensive Recommendations

Because portions of the malware operate almost entirely in memory and may remove traces from disk, traditional file-based detection methods may be insufficient.

Security teams should actively monitor for:

• Unusual DLL loading behavior
• Memory-only executable activity
• Suspicious registry entries containing encrypted data
• Unexpected service creation
• Code injection into SyncHost.exe or svchost.exe
• Unauthorized outbound SSH tunnels
• Suspicious scheduled tasks

One observed persistence mechanism involved a scheduled task launching a VBScript file that executed a renamed SSH client to establish a covert reverse tunnel back to attacker-controlled infrastructure.

Investigators recommend preserving:

• Process memory
• Registry artifacts
• Command-line histories
• DLL load events
• Network telemetry

before terminating suspicious processes or isolating affected systems.

Conclusion

This campaign highlights the growing sophistication of state-sponsored cyber operations targeting trusted software and legitimate websites. By exploiting vulnerabilities in locally deployed financial-security applications, attackers transformed ordinary webpage visits into silent infection opportunities, enabling covert deployment of espionage-focused malware without requiring user interaction.

The incident serves as a powerful reminder that trusted software can become an attack vector, and that organizations must prioritize timely patching, continuous monitoring, and behavioral threat detection to defend against increasingly advanced cyber threats.