9 minhigh
[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)
ASEC identified a campaign dubbed 'Operation Double Barrel' linking a state-sponsored threat group and the Gunra ransomware group through shared exploitation of vulnerabilities in Korean financial security software, common malware families (SIGNBT 3.0 and COPPERHEDGE), overlapping SSH key fingerprints, and shared network infrastructure. The state-sponsored group used watering hole and spear-phishing attacks to deliver backdoors, while the Gunra group used the same initial access vectors to deploy ransomware. The shared infrastructure and techniques suggest limited collaboration or tool sharing between the two actors despite differing end objectives.
Sens:▲ 24h
Detection / Hunteropenrouter
What Happened
A government-backed hacking group and a separate ransomware gang called Gunra have been attacking Korean organizations by exploiting security flaws in Korean financial software that people install for banking and government services. The hackers tricked victims into visiting malicious websites through compromised legitimate Korean websites (in media, education, healthcare, and manufacturing) and through targeted phishing emails. Once the software vulnerability was triggered, the attackers installed backdoor programs that let them control infected computers remotely. The ransomware group used the same vulnerabilities, tools, and infrastructure as the state-sponsored hackers, suggesting the two groups may have shared resources or worked together in some way, even though their goals were different. Organizations using Korean financial security software should check for updates, review their systems for signs of compromise, and be cautious of suspicious emails and websites.
Key Takeaways
- A state-sponsored threat group and the Gunra ransomware group share commonalities in exploited vulnerabilities, malware, SSH key fingerprints, and network infrastructure, suggesting limited collaboration or tool/infrastructure sharing.
- Attackers exploited vulnerabilities in Korean financial security software (products A and I) to deliver backdoors via watering hole and spear-phishing attacks from 2025 through the first half of 2026.
- Backdoors deployed include Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE), alongside a wide toolset including Impacket, PsExec, Plink, Socat, TightVNC, Certipy, PetitPotam, and UACMe.
- Multiple legitimate Korean websites across media, education, healthcare, and manufacturing sectors were compromised for watering hole attacks, with a potential supply chain link through a shared website development/management company.
- Detailed IOCs are gated behind AhnLab TIP subscription; the blog post serves as an advisory summary.
Affected Systems
- Korean financial security software (referred to as 'Financial Security Software A' and 'Financial Security Software I')
- Windows endpoints targeted via watering hole and spear-phishing
- Korean organizational websites across media, education, healthcare, and manufacturing sectors
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Watering hole attacks on legitimate Korean websites and spear-phishing emails lure targets to malicious URLs
- Exploitation: Vulnerabilities in Korean financial security software (products A and I) are exploited to execute code on the target system
- Installation: Dropper deploys backdoor malware — Struggle (SIGNBT 3.0) or Brandoor (COPPERHEDGE) — for persistent remote access
- Privilege Escalation: UACMe and privilege escalation tools are used to elevate privileges on compromised hosts
- Lateral Movement: Tools such as Impacket, PsExec, and MS-SQL access facilitate movement within the network
- Tunneling and Exfiltration: Plink and Socat establish reverse tunnels; data is exfiltrated via tools like FileZilla and WinSCP; in ransomware cases, Gunra encrypts files and exfiltrates organizational data
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: AhnLab TIP (subscription required)
The blog post is an advisory summary; detailed IOCs, file hashes, domains, URLs, and IP addresses are available only through a paid AhnLab TIP subscription. No detection rules are provided in the public article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The article references multiple legitimate tools (PsExec, Plink, Socat, TightVNC, FileZilla, WinSCP, Impacket) that may generate process creation events visible to EDR, but distinguishing malicious use from administrative activity requires behavioral context not available in the public summary. |
| Network Visibility | Medium | Reverse tunneling via Plink and Socat, SSH connections, and potential C2 traffic could be visible in network logs, but specific C2 infrastructure details are behind the AhnLab TIP paywall. |
| Detection Difficulty | Hard | Attackers abuse legitimate administrative tools and exploit client-side vulnerabilities in region-specific financial software. Without the detailed IOCs from the full report, defenders must rely on behavioral detection of dual-use tooling, which carries high false positive risk in environments where these tools are used legitimately. |
Required Log Sources
- Process creation events (Sysmon Event ID 1 / EDR equivalent)
- Network connection events (Sysmon Event ID 3 / firewall logs)
- Windows Security Event ID 4624/4625 (authentication events)
- Windows Security Event ID 4688 (process creation)
- Web proxy logs for watering hole domains
- DNS resolution logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for instances of Plink or Socat initiating outbound reverse tunnel connections from endpoints, which may indicate C2 tunneling activity (T1572). | Network connection logs and process creation events showing Plink or Socat with outbound connection arguments | Command and Control | Medium — Plink and Socat may be used legitimately by IT administrators for SSH tunneling. |
| Consider hunting for PsExec or Impacket-based service execution originating from non-administrative workstations or at unusual times, which may indicate lateral movement (T1569.002). | Windows Security Event ID 4624 (logon type 3), Sysmon Event ID 1 for PsExec service creation, and Event ID 7045 for new service creation | Lateral Movement | Medium — PsExec is commonly used by IT teams for remote administration. |
| Consider hunting for TightVNC or similar remote access software executed from non-standard directories or by non-admin users, which may indicate attacker remote access (T1219). | Process creation events for TightVNC binaries, especially from temp directories or user profiles | Persistence / Command and Control | Low to Medium — TightVNC usage is less common in enterprise environments and more suspicious when found outside standard install paths. |
| Consider hunting for UACMe or UAC bypass techniques followed by privilege escalation activity, which may indicate an attacker escalating privileges after initial compromise (T1548.002). | Process creation events showing UACMe-related binaries or COM object hijack patterns, followed by elevated process creation | Privilege Escalation | Low — UACMe is not a standard administrative tool and its presence is highly suspicious. |
| Consider hunting for Certipy or PetitPotam-related activity targeting Active Directory, which may indicate credential access or NTLM relay attacks (T1212, T1557.001). | Windows Security Event logs for unusual NTLM authentication patterns, process creation for Certipy, and network connections to domain controllers from non-standard hosts | Credential Access | Low — These tools are not part of standard administrative workflows. |
Control Gaps
- Signature-based AV may miss backdoor malware delivered through financial software exploitation if the payloads are novel or obfuscated.
- Network-based detection may not catch reverse tunnels over SSH (Plink) if outbound SSH is permitted in the environment.
- Application allowlisting may not flag legitimate dual-use tools (PsExec, FileZilla, WinSCP) that are already installed or permitted.
- Watering hole attacks on legitimate Korean websites may bypass URL filtering since the initial domains are reputable.
Key Behavioral Indicators
- Process ancestry showing browser process spawning unexpected child processes (indicative of client-side exploitation of financial security software)
- Plink or Socat executed with reverse tunnel arguments from user workstations rather than servers
- UACMe or HookShot binaries executed from temp or user-profile directories
- Certipy or PetitPotam-related process execution on non-domain-controller hosts
- Webshell activity on IIS or Apache servers associated with the compromised Korean website development company
- TightVNC service installation or execution outside of standard IT deployment procedures
False Positive Assessment
Medium — The attack leverages legitimate dual-use administrative tools (PsExec, Plink, Socat, FileZilla, WinSCP, TightVNC) that may be present and used legitimately in many environments, particularly in IT-managed Korean organizations. Behavioral detections for these tools require careful baselining to avoid alert fatigue.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing endpoints for presence of SIGNBT 3.0 (Struggle), COPPERHEDGE (Brandoor), and the dual-use tools listed (Plink, Socat, PsExec, Impacket, TightVNC, Certipy, UACMe) if your organization operates in Korea or uses Korean financial security software.
- Consider checking whether Korean financial security software products are installed and whether vendor patches for the exploited vulnerabilities are available; if patches exist, evaluate prioritizing deployment.
- If applicable, consider blocking known watering hole domains identified in the full AhnLab TIP report at web proxies and DNS filters.
Infrastructure Hardening
- Consider restricting outbound SSH connectivity from workstations to only known and approved destinations, which would limit Plink-based reverse tunneling.
- Evaluate whether PsExec, Impacket, and other remote execution tooling can be restricted or monitored more closely in your environment.
- If your organization manages external-facing websites, consider auditing whether a shared website development/management vendor has access, and review for signs of supply chain compromise.
- Consider implementing network segmentation to limit lateral movement opportunities if an endpoint is compromised via client-side exploitation.
User Protection
- Consider deploying endpoint detection rules for the dual-use tools mentioned (Plink, Socat, TightVNC, UACMe, Certipy) if they are not part of your standard toolset.
- Evaluate whether application allowlisting could prevent execution of unexpected binaries dropped through financial software exploitation.
- If your EDR supports it, consider enabling behavioral detection for browser-to-child-process anomalous execution chains, which would catch the initial exploitation stage.
Security Awareness
- Consider reminding users who interact with Korean financial or government services to be cautious of unexpected emails containing links, especially those prompting software installation or updates.
- Consider incorporating watering hole attack awareness into existing security training, emphasizing that even legitimate and trusted websites can serve malicious content if compromised.
- If applicable to your workforce, consider briefing IT staff on the risk of supply chain compromise through shared website management vendors.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Initial Access
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Collection
Tactic