Lazarus Group Targets South Korean Cryptocurrency Exchanges

• •Lazarus Group is linked to recent cryptocurrency exchange attacks in South Korea.
• •The campaign uses the Ghostscript exploit (CVE-2017-8291) targeting Hangul Word Processor users.
• •The malware's use of Chinese terms suggests a potential false flag or external involvement.

The Lazarus Group, linked to North Korea, is behind recent attacks on cryptocurrency exchanges in South Korea. Security researchers from Recorded Future have identified a spear phishing campaign aimed at cryptocurrency users and South Korean college students. The malware used includes the Ghostscript exploit (CVE-2017-8291), specifically tailored for users of Hancom's Hangul Word Processor, which is widely used in South Korea. This campaign follows a historical pattern of Lazarus Group attacks that have previously targeted financial institutions to fund North Korea's activities. The use of Chinese terms in the malware suggests a potential false flag operation or the involvement of a Chinese exploit supplier. The campaign was launched shortly before North Korean leader Kim Jong-un's New Year speech, indicating a possible strategic timing. Researchers have noted that North Korean state actors have utilized similar exploits in past phishing campaigns.