Lazarus Group Turns South Korean Banking Security Software Into Espionage Tool
Researchers say North Korea–linked Lazarus hackers are abusing South Korean banking security software to install new espionage backdoors, with payloads hosted on GitHub and malware communications shielded by post‑quantum encryption. The campaign turns a trusted layer of online banking into a long‑term surveillance channel.
A new espionage campaign tied to North Korea’s Lazarus group is targeting South Korea’s financial system at its security perimeter.
According to security researchers, Lazarus operators are exploiting South Korean banking security software to distribute malware. In South Korea, such software is widely used and in some cases mandatory for accessing online banking and certain official services, which gives attackers a direct line into systems that users already trust.
The group is reportedly using this access to deploy new backdoors that provide persistent remote control, data theft and command‑and‑control functions. The malicious payloads are hosted on GitHub, blending into normal developer and update traffic and making it harder for defenders to distinguish hostile requests from legitimate ones.
One of the most notable features of the campaign is its use of post‑quantum encryption to protect some malware communications. These cryptographic schemes are designed to withstand decryption by future quantum computers. Their deployment in current operations indicates that Lazarus expects to keep and potentially exploit stolen data over long periods and wants to shield it against advances in decryption.
For South Korean users, the risk runs through everyday financial activity. Banking logins, transaction details and identity data all depend on the integrity of the security software now under attack. If that layer is compromised, attackers can quietly monitor or manipulate a wide range of financial information.
The campaign also has implications abroad. Foreign partners that interact with South Korean banks, or that use similar security products, could be exposed to secondary risks if compromised systems are used to move money, share documents or manage joint ventures.
The key lesson is that when attackers compromise trusted protective tools, they gain far more than access to a single device. They gain a position inside a system that many people rely on by default.
Signals to watch include emergency updates or replacement software rolled out by South Korean banks and regulators, the takedown of malicious GitHub infrastructure linked to the operation, and any indication that the same malware framework is appearing in other countries that use comparable banking security systems.
Sources
- OSINT