Hackers Exploit Any Sign4PC via Hacked Korean Sites to Install Backdoors Without Prompts
Summary: South Korean authorities and four security firms disclosed a state-sponsored campaign that compromised trusted domestic websites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors, with KISA listing AnySign4PC versions 1.1.4.4 through 1.1.4.6 as vulnerable and 1.1.5.0 as the fixed release. AhnLab said it identified evidence of related attacks at 72 organizations in 2026 and found 15 legitimate websites used as watering holes, with shared indicators including the SSH key fingerprint Qr1to32lQHxEu6phzNyrTZrU0iElrOfVWMBLnqoen24 and the address 176.65.128[.]26 also appearing in Gunra ransomware intrusions.
What you should know: A visit to a compromised page could install a backdoor on a vulnerable AnySign4PC system with no prompt and no download, and the same access path, filenames, SSH key fingerprint, and infrastructure later appeared in a Gunra ransomware intrusion - so an espionage foothold and a ransomware entry point may be the same door.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026