DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

72 South Korean organizations across financial, healthcare, and other sectors (via 15 compromised watering-hole websites)

Date (as written)
2026-07-30
Year
2026
Country
KR
Actors (as written)
Unattributed state-sponsored group (possible Lazarus links, unconfirmed)
Actor pages
Unattributed state-sponsored group
Tags (as written)
Attack: Malware; Attack Class: Cyber Espionage

Source entries (1)

Hackmageddon cyber attacks timelines (Paolo Passeri)

72 South Korean organizations across financial, healthcare, and other sectors (via 15 compromised watering-hole websites) · 2026-07-30
South Korean authorities (KISA, NIS, NPA, FSI) and AhnLab, S2W, ENKI Whitehat, and Plainbit disclose 'Operation Double Barrel,' a watering-hole campaign exploiting a zero-day in financial-security software AnySign4PC via 15 compromised legitimate websites to silently deploy SIGNBT and COPPERHEDGE backdoors, with evidence found at 72 organizations. [Date Occurred: Since H2 2025; Date Discovered: Since H2 2025]
https://www.hackmageddon.com/2026/08/06/16-31-july-2026-cyber-attacks-timeline/
https://thehackernews.com/2026/07/hackers-exploit-anysign4pc-via-hacked.html

Suggest a correction on GitHub