cyber.hendryadrian.com
Threat Research · asec.ahnlab.com

AhnLab Links State-Sponsored Attacks and Gunra Ransomware Through Shared Tools and Infrastructure

· Original article ↗

Summary

AhnLab’s report analyzes attacks exploiting Korean financial security software to deliver backdoors or Gunra ransomware, finding shared vulnerabilities, malware, SSH fingerprints and infrastructure that may indicate limited collaboration.

Key points

  • AhnLab identified activity from 2025 through the first half of 2026 involving vulnerabilities in Korean financial security software.
  • Attackers used watering-hole and spear-phishing lures to deliver malware; compromised legitimate websites included media, education, healthcare and manufacturing organizations.
  • Some attacks installed Struggle (SIGNBT 3.0) or Brandoor (COPPERHEDGE) backdoors, while others deployed Gunra ransomware to encrypt files and exfiltrate sensitive information.
  • The report identifies overlap in exploited vulnerabilities, malware, SSH key fingerprints and network infrastructure across the state-sponsored activity and Gunra attacks.
  • AhnLab says the overlaps may indicate shared tools or infrastructure, or limited collaboration, but cannot definitively establish a relationship between the groups.
  • The analysis examines possible supply-chain links involving websites associated with the same Korean website development and management company.

Article Details

Attack Vectors
  • Watering-hole attacks induced targets to access malicious URLs, with legitimate Korean websites across media, education, healthcare, and manufacturing reported as abused.
  • Spear-phishing was used to induce targets to access malicious URLs.
  • Attackers exploited vulnerabilities in Korean financial security software to install backdoor malware; related attacks resulted in Gunra ransomware being installed.

MITRE ATT&CK

T1189 · Drive-by CompromiseThe article reports watering-hole attacks that abused legitimate Korean websites to induce targets to access malicious URLs.T1566 · PhishingThe article reports spear-phishing attacks that induced targets to access malicious URLs.

Threat Actors

Gunra ransomware groupThe article attributes attacks to this group in which Gunra ransomware was installed to encrypt files and exfiltrate sensitive organizational information.

Malware

COPPERHEDGEIt also analyzes the backdoors ultimately installed, including Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE), along with the tools abused during the attacks.Gunra[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)StruggleIt also analyzes the backdoors ultimately installed, including Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE), along with the tools abused during the attacks.

Countries

South Korea

Industries

EducationHealthcareKorean websites across various industries, including media organizations, educational institutions, healthcare institutions, and manufacturing companies, were confirmed to have been abused in watering hole attacksManufacturingindustries, including media organizations, educational institutions, healthcare institutions, and manufacturing companies, were confirmed to have been abused in watering hole attacks during this period.MediaIn particular, legitimate Korean websites across various industries, including media organizations, educational institutions, healthcare institutions, and manufacturing companies, were confirmed to have been abused in

Related Articles