South Korea's National Intelligence Service reportedly concluded after an onsite investigation that Lazarus compromised an Active Directory server used for the Supreme Court's internet virtualization system. The report says the attackers used administrator access to expose employee accounts and move into the judiciary's internal network, with possible access beyond the previously known Seoul Central District Court scan server. At least 335 GB of data was believed to have been exfiltrated, but investigators had not yet determined the full scope or the specific court records, personal data, or business secrets affected. The activity was linked to malware first created around March 2021, while the Court Administration Office was criticized for delaying public disclosure after detecting the incident in 2023.