Lazarus Strikes South Korea: Zero-Day Malware Unleashes Cyber Chaos

At a glance

• Lazarus Group’s Attack: The North Korea-linked Lazarus group compromised at least six South Korean organizations, according to Kaspersky.
• State-Backed Operation: Lazarus is widely tied to the North Korean state, and the campaign fits its long record of espionage and theft.
• Exploitation of Flaws: The attackers abused flaws in South Korean software, including Cross EX and the Innorix Agent file-transfer tool.
• Industrial Targets: Victims were in the software, IT, finance, semiconductor and telecom sectors.
• Wider Implications: The campaign shows how attacks on widely used local software can spread through a whole supply chain.

Operation SyncHole

Kaspersky has tracked a Lazarus campaign it calls Operation SyncHole, which ran from November 2024 into February 2025 and compromised at least six South Korean organizations. The attackers used watering-hole attacks, planting malicious code on legitimate South Korean websites that their targets visited. Lazarus has a long track record. This campaign shows it still finds new ways in, and the damage goes beyond lost data because the victims sit in key supply chains.

The software flaws behind the attack

The attackers likely exploited Cross EX, security software that many South Korean websites require, to get their malware running. They then abused a flaw in Innorix Agent, a file-transfer tool, to move to other machines inside networks. Kaspersky also found a separate zero-day flaw in Innorix Agent that had not been used in the attacks and reported it to the Korea Internet & Security Agency (KrCERT), and the vendor patched it.

Espionage targets

The victims worked in software, IT, finance, semiconductors and telecommunications. Those industries hold valuable technology and intellectual property. Groups like Lazarus often chase long-term strategic gains through espionage as well as quick financial wins, so companies in these sectors are under steady pressure.

Why South Korean software is a target

South Korea relies on a handful of locally made security and file-transfer tools that many websites and companies are required to use. When one of them has a flaw, attackers can reach many organizations at once. That makes these tools a prized target.

What it means for defenders

The SyncHole campaign shows how one widely used piece of software can expose many companies. Vendors of these tools need faster patching and better testing. Governments and security firms also need to share findings quickly, as Kaspersky did with KrCERT.

Building Resilient Defenses

Keep required third-party software up to date and watch for unusual behavior from trusted tools. Test often. Layered security and staff who can recognize suspicious activity both lower the risk of a repeat.

The lesson from SyncHole

Lazarus keeps going after South Korean targets, and its methods keep improving. Companies that depend on widely deployed local software should treat it as part of their attack surface and patch it as quickly as anything else.

Kaspersky’s findings are a reminder that the software everyone is required to install can become the easiest way in.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.