North Korean Hackers Strike Again: Xctdoor Backdoor Compromises South Korean ERP Systems
A South Korean ERP vendor’s update server was hacked to deliver Xctdoor, a Go-based backdoor. ASEC linked the tactics to the Andariel sub-cluster of the Lazarus Group. The malware steals data using regsvr32.exe to execute a DLL file, with additional attacks employing XcLoader.
Hot Take:
Looks like the North Korean cyber ninjas are back at it again, sneaking their malware into software updates like a digital Trojan horse. Maybe it’s time we start treating software updates like surprise packages from your in-laws—open with caution!
Key Points:
- South Korean ERP vendor’s update server compromised to deliver Xctdoor backdoor.
- Attack attributed to tactics similar to North Korean group Andariel.
- Xctdoor steals system info and communicates via HTTP using Mersenne Twister and Base64 encryption.
- XcLoader injects Xctdoor into legitimate processes like “explorer.exe”.
- Parallel attacks by Kimusky and Konni groups using similar sophisticated techniques.
Already a member? Log in here