South Korean authorities, in collaboration with security firms **AhnLab**, **S2W**, **ENKI Whitehat**, and **Plainbit**, have disclosed details of a state-sponsored cyberattack campaign. This operation compromised trusted domestic websites, turning them into watering holes to exploit vulnerabilities in locally installed financial-security software. The primary target was **AnySign4PC**, a widely used certificate-based electronic signature software. Attackers exploited versions 1.1.4.4 through 1.1.4.6, with **Korea Internet & Security Agency (KISA)** recommending an upgrade to version 1.1.5.0 or deletion of vulnerable installations.  ### A Page Visit Was Enough Compromised web pages were designed to infect systems running vulnerable **AnySign4PC** versions without requiring any user prompts or downloads. **ENKI Whitehat** identified this as a zero-day flaw, observing activity from the second half of 2025, predating KISA's June 2026 patch notice. The joint advisory, issued by **KISA**, the **National Intelligence Service**, **National Police Agency**, and **Financial Security Institute**, underscores the ongoing nature of state-sponsored phishing and watering-hole attacks. Attackers employed spear-phishing tactics, disguising messages as resumes, recruitment offers, investment materials, and industry surveys. Concurrently, they compromised legitimate websites across various sectors, including news, healthcare, education, and manufacturing, anticipating visits from their intended victims.  ### Exploit Chain and Payloads **AhnLab's** "Operation Double Barrel" report details an exploit chain involving four PNG images used for key exchange, software version checks, delivery of version-specific exploit code, and execution success reporting. The malicious page communicated with the local security program via WebSocket, triggering a buffer overflow to execute shellcode. Payloads were then injected into legitimate **Microsoft** processes. Depending on the intrusion, attackers deployed **Struggle** (mapped to **SIGNBT 3.0**) or **Brandoor** (identified as the **COPPERHEDGE backdoor**). These backdoors facilitated remote command execution, file exfiltration, internal reconnaissance, process injection, and the delivery of additional payloads. **Plainbit's** forensic report independently reconstructed one watering-hole incident. It revealed attackers mapping victim's internet-facing systems, compromising websites, installing webshells, and injecting JavaScript into news articles. Upon a target's visit, the vulnerable security program generated an error, creating a malicious DLL without user interaction.  Subsequent actions included privilege escalation exploits, use of credential tools like **Mimikatz**, Remote Desktop Protocol connections, and **NLBrute** for lateral movement within networks. **S2W's** analysis of malware clusters showed recurring patterns of DLL side-loading, encrypted registry blobs, and in-memory Portable Executable loading, deploying **SIGNBT** versions 0.0.1 and 1.2. ### The Gunra Trail and Overlaps Intriguingly, evidence suggests an overlap with **Gunra ransomware** intrusions. A March 2026 **Gunra** attack used the same compromised healthcare website and vulnerability in what **AhnLab** refers to as "financial-security software A." Both state-sponsored and ransomware chains injected code into SyncHost.exe. Further shared indicators include the filenames net.tmp and inet.tmp, an identical SSH public-key fingerprint (`Qr1to32lQHxEu6phzNyrTZrU0iElrOfVWMBLnqoen24`), and the reverse-tunnelling address `176.65.128[.]26`. The domain `jshosting[.]me` was also used to distribute exploit scripts in both attack sets. Attackers consistently followed anti-forensic procedures, renaming malicious files to random four-character names before deletion. **Plainbit** observed additional evidence destruction using **SDelete** and **CCleaner**. While the technical links are strong, **AhnLab** stated it could not definitively determine the relationship between the operators, citing possibilities like limited collaboration, shared tools or infrastructure, use of a common access broker, or access to the same operational resources. The overlaps point to a shared or reused access path, but not necessarily the same operator controlling both campaigns. **Gunra** operates as a ransomware-as-a-service program, according to separate research from **S2W**, which reported 32 affected companies as of March 9, 2026.