Korean Mal Doc Drops Evil New Years Presents
Summary: Cisco Talos analyzed a Korean-language malicious HWP document posing as a Ministry of Unification publication titled "Analysis of 'Northern New Year' in 2017," whose embedded OLE objects drop and execute two PE32 binaries when a user double-clicks the decoy links. The second stage runs wscript.exe, injects shellcode via VirtualAllocEx, WriteProcessMemory and CreateRemoteThread to unpack a reconnaissance payload, and the sample attempted C2 connections to URLs including kgls.or.kr, the Korean Government Legal Service site, which Talos believes was compromised to serve a file masquerading as a jpeg.
Why it matters: The attackers rotated infrastructure every few days, cleaned up compromised sites, and had removed the final payload before Talos could retrieve it - so the operators behind a campaign aimed at South Korean public-sector targets remain unidentified and their tooling unanalyzed.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026