{"id":38214,"date":"2020-11-16T15:51:43","date_gmt":"2020-11-16T15:51:43","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31765\/Lazarus-Malware-Strikes-South-Korean-Supply-Chains.html"},"modified":"2020-11-16T15:51:43","modified_gmt":"2020-11-16T15:51:43","slug":"lazarus-malware-strikes-south-korean-supply-chains","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/","title":{"rendered":"Lazarus Malware Strikes South Korean Supply Chains"},"content":{"rendered":"<p>Lazarus malware has been tracked in new campaigns against South Korean supply chains, made possible through stolen security certificates.&nbsp;<\/p>\n<p>On Monday, cybersecurity researchers from <a href=\"https:\/\/www.welivesecurity.com\/2020\/11\/16\/lazarus-supply-chain-attack-south-korea\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">ESET revealed<\/a> the abuse of the certificates, stolen from two separate, legitimate South Korean companies.&nbsp;<\/p>\n<p>Lazarus, also known as Hidden Cobra, is an umbrella term for select threat groups &#8212; including offshoot entities &#8212; suspected of being tied to North Korea. Thought to be responsible for Sony&#8217;s infamous <a href=\"https:\/\/www.zdnet.com\/article\/north-korea-s-apt38-hacking-group-behind-bank-heists-of-over-100-million\/\" target=\"_blank\" rel=\"noopener noreferrer\">2014 hack<\/a>, Lazarus has also been connected to hacks using <a href=\"https:\/\/www.zdnet.com\/article\/north-korea-linked-lazarus-group-attacked-south-korean-think-tank-through-activex-zero-day\/\" target=\"_blank\" rel=\"noopener noreferrer\">zero-day vulnerabilities<\/a>, LinkedIn <a href=\"https:\/\/www.zdnet.com\/article\/lazarus-group-strikes-cryptocurrency-firm-through-linkedin-job-adverts\/\" target=\"_blank\" rel=\"noopener noreferrer\">phishing messages<\/a>, and the deployment of&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/lazarus-pivots-to-linux-attacks-through-dacls-trojan\/\" target=\"_blank\" rel=\"noopener noreferrer\">Trojans<\/a>&nbsp;in campaigns including Dacls and Trickbot.&nbsp; <\/p>\n<p><strong>See also:&nbsp;<\/strong><a href=\"https:\/\/www.zdnet.com\/article\/lazarus-group-strikes-cryptocurrency-firm-through-linkedin-job-adverts\/\" target=\"_blank\" rel=\"noopener noreferrer\">Lazarus group strikes cryptocurrency firm through LinkedIn job adverts<\/a> <\/p>\n<p>In recent years, Lazarus has expanded its attack surface not only for the theft of sensitive data from corporations but also in order to compromise cryptocurrency organizations.&nbsp; <\/p>\n<p>In this supply chain attack, the threat actors are using an &#8220;unusual supply chain mechanism,&#8221; ESET says, in which Lazarus is abusing a standard requirement for South Korean internet users &#8212; the need to install additional security software when they visit government or financial services websites.&nbsp; <\/p>\n<p>Typically, users will be required to download WIZVERA VeraPort, a program used to manage software downloads that are necessary to visit particular domains. These updates may include browser plugins, standalone security software, or identity verification tools.&nbsp; <\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\"> <\/section>\n<p>WIZVERA VeraPort digitally signs and cryptographically verifies downloads. <\/p>\n<p>&#8220;[This] is why attackers can&#8217;t easily modify the content of these configuration files or set up their own fake website,&#8221; the researchers say. &#8220;However, the attackers can replace the software to be delivered to WIZVERA VeraPort users from a legitimate but compromised website. We believe this is the scenario the Lazarus attackers used.&#8221; <\/p>\n<figure class=\"image image-large shortcode-image\"><span class=\"img aspect-set \"><img decoding=\"async\" src=\"https:\/\/zdnet1.cbsistatic.com\/hub\/i\/r\/2020\/11\/16\/24374588-ce5a-4730-a046-a44c6e601fac\/resize\/470xauto\/d38879409bb268c8bbaa86ec88330f8b\/screenshot-2020-11-16-at-08-20-39.png\" class alt=\"screenshot-2020-11-16-at-08-20-39.png\" height=\"auto\" width=\"470\"><\/span><figcaption><span class=\"caption\"><\/span><\/figcaption><\/figure>\n<p>Lazarus has targeted the weaker links in the chain by illegally obtaining code-signing certificates from two South Korean security companies.&nbsp;<\/p>\n<p>WIZVERA VeraPort&#8217;s default configuration usually requires the signatures of downloaded binaries to be verified before execution. However, the software manager only verifies the signature and not who certificates belong to.&nbsp; <\/p>\n<p><strong>CNET:&nbsp;<\/strong><a href=\"https:\/\/www.cnet.com\/news\/rules-for-strong-passwords-dont-work-researchers-find-heres-what-does\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">Rules for strong passwords don&#8217;t work, researchers find. Here&#8217;s what does<\/a> <\/p>\n<p>In order to exploit the software, the stolen &#8212; but valid &#8212; certificates were used to launch Lazarus malware payloads.&nbsp; <\/p>\n<p>So far, two malware samples have been detected that camouflage the group&#8217;s malware as legitimate, South Korean software that is often downloaded and executed by WIZVERA VeraPort. Similar file names, icons, and resources to legitimate software have been crafted to avoid arousing suspicion.&nbsp; <\/p>\n<p>If a victim visits a malicious website, for example, and unwittingly downloads the compromised software, Lazarus will then launch a dropper via WIZVERA VeraPort which extracts a downloader and configuration files.&nbsp; <\/p>\n<p><strong>TechRepublic:&nbsp;<\/strong><a href=\"https:\/\/www.techrepublic.com\/article\/hackers-for-hire-target-victims-with-cyber-espionage-campaign\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">Hackers for hire target victims with cyber espionage campaign<\/a> <\/p>\n<p>A connection is then established with the attacker&#8217;s command-and-control (C2) server and the final payload, a Remote Access Trojan (RAT), is deployed on a victim&#8217;s machine. RATs can be used to maintain covert surveillance, persistence via backdoors, and for the exfiltration of data or remote system control.<\/p>\n<p>&#8220;It&#8217;s the combination of compromised websites with WIZVERA VeraPort support and specific VeraPort configuration options that allow attackers to perform this attack,&#8221; ESET says. &#8220;Owners of such websites could decrease the possibility of such attacks, even if their sites are compromised, by enabling specific options (e.g. by specifying hashes of binaries in the VeraPort configuration).&#8221; <\/p>\n<h3> Previous and related coverage <\/h3>\n<hr>\n<p><strong>Have a tip?<\/strong> Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0<\/p>\n<hr>\n<p> READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/31765\/Lazarus-Malware-Strikes-South-Korean-Supply-Chains.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":38215,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[60],"tags":[9045],"class_list":["post-38214","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-packet-storm","tag-headlinemalwarekoreascada"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Lazarus Malware Strikes South Korean Supply Chains 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Lazarus Malware Strikes South Korean Supply Chains 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-11-16T15:51:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/lazarus-malware-strikes-south-korean-supply-chains.png\" \/>\n\t<meta property=\"og:image:width\" content=\"470\" \/>\n\t<meta property=\"og:image:height\" content=\"528\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Lazarus Malware Strikes South Korean Supply Chains\",\"datePublished\":\"2020-11-16T15:51:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/\"},\"wordCount\":602,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/lazarus-malware-strikes-south-korean-supply-chains.png\",\"keywords\":[\"headline,malware,korea,scada\"],\"articleSection\":[\"Packet Storm\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/\",\"name\":\"Lazarus Malware Strikes South Korean Supply Chains 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/lazarus-malware-strikes-south-korean-supply-chains.png\",\"datePublished\":\"2020-11-16T15:51:43+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/lazarus-malware-strikes-south-korean-supply-chains.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/lazarus-malware-strikes-south-korean-supply-chains.png\",\"width\":\"470\",\"height\":\"528\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/lazarus-malware-strikes-south-korean-supply-chains\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,malware,korea,scada\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinemalwarekoreascada\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Lazarus Malware Strikes South Korean Supply Chains\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Lazarus Malware Strikes South Korean Supply Chains 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/","og_locale":"en_US","og_type":"article","og_title":"Lazarus Malware Strikes South Korean Supply Chains 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-11-16T15:51:43+00:00","og_image":[{"width":470,"height":528,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/lazarus-malware-strikes-south-korean-supply-chains.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Lazarus Malware Strikes South Korean Supply Chains","datePublished":"2020-11-16T15:51:43+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/"},"wordCount":602,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/lazarus-malware-strikes-south-korean-supply-chains.png","keywords":["headline,malware,korea,scada"],"articleSection":["Packet Storm"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/","url":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/","name":"Lazarus Malware Strikes South Korean Supply Chains 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/lazarus-malware-strikes-south-korean-supply-chains.png","datePublished":"2020-11-16T15:51:43+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/lazarus-malware-strikes-south-korean-supply-chains.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/11\/lazarus-malware-strikes-south-korean-supply-chains.png","width":"470","height":"528"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/lazarus-malware-strikes-south-korean-supply-chains\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,malware,korea,scada","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinemalwarekoreascada\/"},{"@type":"ListItem","position":3,"name":"Lazarus Malware Strikes South Korean Supply Chains"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/38214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=38214"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/38214\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/38215"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=38214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=38214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=38214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}