Exploited AnySign4PC

Overview

South Korean authorities and security firms have disclosed a state‑sponsored campaign that compromised trusted domestic websites to exploit AnySign4PC, a financial‑security program used for certificate‑based electronic signatures. Vulnerable versions (1.1.4.4 through 1.1.4.6) allowed attackers to install SIGNBT or COPPERHEDGE backdoors silently — without user prompts or downloads.

How the Exploit Works

• Watering‑hole attacks: Legitimate websites in healthcare, education, manufacturing, and news were compromised.
• Exploit chain:
  • Malicious PNG images exchanged keys and delivered version‑specific exploit code.
  • Vulnerable AnySign4PC communicated with injected JavaScript via WebSocket.
  • A buffer overflow executed shellcode, injecting payloads into Microsoft processes.
• Payloads:
  • SIGNBT (Struggle) and COPPERHEDGE (Brandoor) backdoors.
  • Supported remote command execution, file theft, reconnaissance, process injection, and additional payload delivery.

Attack Techniques Observed

• DLL side‑loading and encrypted registry blobs.
• In‑memory PE execution to avoid detection.
• Privilege escalation using exploits, Mimikatz, and credential theft tools.
• Persistence chains: Scheduled tasks launching renamed SSH clients to establish reverse tunnels.
• Anti‑forensics: File renaming, deletion, and use of SDelete/CCleaner to erase evidence.

Links to Gunra Ransomware

• Overlaps with Gunra ransomware intrusions in March 2026:
  • Same compromised healthcare website.
  • Same vulnerability in financial‑security software.
  • Shared filenames (net.tmp, inet.tmp), SSH key fingerprints, and reverse‑tunneling infrastructure.
• Evidence suggests shared access paths or reused infrastructure, but attribution remains unclear.

Attribution and Actor Landscape

• Current advisories describe the operator only as a state‑sponsored group.
• Lazarus Group has historically used AnySign4PC, SIGNBT, and COPPERHEDGE in watering‑hole campaigns, but Operation Double Barrel and Gunra intrusions are not formally attributed to Lazarus.
• Gunra operates as ransomware‑as‑a‑service, affecting 32 companies by March 2026.

Defensive Guidance

• Patch AnySign4PC: Upgrade to version 1.1.5.0 or delete vulnerable installations.
• Hunt suspicious behavior: Look for DLL loading by legitimate executables, encrypted registry data, and in‑memory PE execution.
• Monitor persistence: Scheduled tasks, renamed executables, and outbound SSH tunnels.
• Preserve forensic evidence: Capture process memory, command lines, registry values, DLL‑load events, and network records before remediation.
• Limit supply‑chain exposure: Audit connected websites and development platforms for compromise.

Expert in the Cloud Insight

This campaign underscores the danger of trusted local software becoming a silent infection vector. By exploiting AnySign4PC without prompts, attackers bypassed user awareness entirely. The overlap with ransomware shows how espionage‑focused campaigns can bleed into criminal monetization. For defenders, the lesson is clear: patch quickly, hunt behavior not just files, and treat financial‑security software as high‑risk infrastructure.