Okay, deep breath, let's get this over with. In the grand act of digital self-sabotage, we've littered this site with cookies. Yep, we did that. Why? So your highness can have a 'premium' experience or whatever. These traitorous cookies hide in your browser, eagerly waiting to welcome you back like a guilty dog that's just chewed your favorite shoe. And, if that's not enough, they also tattle on which parts of our sad little corner of the web you obsess over. Feels dirty, doesn't it?
North Korean Hackers Strike Again: Xctdoor Backdoor Compromises South Korean ERP Systems
A South Korean ERP vendor’s update server was hacked to deliver Xctdoor, a Go-based backdoor. ASEC linked the tactics to the Andariel sub-cluster of the Lazarus Group. The malware steals data using regsvr32.exe to execute a DLL file, with additional attacks employing XcLoader.
Hot Take:
Looks like the North Korean cyber ninjas are back at it again, sneaking their malware into software updates like a digital Trojan horse. Maybe it’s time we start treating software updates like surprise packages from your in-laws—open with caution!
Key Points:
- South Korean ERP vendor’s update server compromised to deliver Xctdoor backdoor.
- Attack attributed to tactics similar to North Korean group Andariel.
- Xctdoor steals system info and communicates via HTTP using Mersenne Twister and Base64 encryption.
- XcLoader injects Xctdoor into legitimate processes like “explorer.exe”.
- Parallel attacks by Kimusky and Konni groups using similar sophisticated techniques.
Already a member? Log in here