Sejong Institue · 2018-05
The Sejong Institute incident was a South Korea-focused watering-hole operation against reunification, diplomacy, and security stakeholders, using an ActiveX vulnerability in AcubeFileCtrl.ocx before version 2.3.0.4 to download and execute malware. The injected JavaScript collected browser and ActiveX installation details and sent them to attacker infrastructure, while the malware authenticated to C2, used RC4 with a fixed key, collected host details, and executed commands through cmd.exe.
CSIS entry 839 · June 2018
Researchers reveal that North Korean hackers targeted a South Korean think tank focused on national security issues. The hackers used a zero -day exploit to compromise the organization’s website and insert a backdoor for injecting code.
Andariel (Subgroup of Lazarus) attacks South Korean think tank · 12.06.2018
According to researchers at AlienVault, North Korea-linked hackers planted an ActiveX zero-day vulnerability on the website of a South Korean think tank focused on national security.
Sejong Institute Hack · 5/1/2018
North Korea attacked South Korean national security think tank using a zero-day on the organization's website.
South Korean Think Tank · 2018-06-11
North Korea-linked Lazarus APT Group planted an ActiveX zero-day exploit on the website of a South Korean think tank focused on national security.
Sejong Institue · 2018-05
Reported: 2018-05; Victims: Sejong Institue; Motivations: Espionage Wateringhole; Sectors: Research; Countries: Korea, Republic of
South Korean Think Tank · 11/06/2018
North Korea-linked Lazarus APT Group planted an ActiveX zero-day exploit on the website of a South Korean think tank focused on national security.