CBS NoCutNews reported that South Korea's Supreme Court had internally attributed a judiciary network compromise to Lazarus malware months before publicly saying the actor could not be confirmed. An April confidential report from the National Court Administration's cyber safety office reportedly titled the case as Lazarus malware analysis and documented activity from an estimated March 2021 malware creation date through security checks in February 2023. The report said Trojan/Win.Lazardoor was first detected on a Seoul Central District Court server and that related malicious files appeared on internet virtual PCs. It also described five exfiltration events from December 2022 to January 2023 totaling about 335.14 GB, routed from a Seoul court scan server through virtual PCs to two external IP addresses.