north2021.11.pdf (2 MB)

Somansa's report reviews document-based malware attacks by North Korean hacking groups against South Korean targets. It describes Lazarus, Kimsuky, ScarCruft, and Andariel as groups conducting spear-phishing and APT operations against major companies, the Ministry of National Defense, defense contractors, government-related bodies, and other institutions. The analyzed cases used malicious documents with embedded code and deceptive filenames or themes to persuade victims to open files, allowing attacker-controlled malware to run on the victim's PC.