Xctdoor Malware Used in Attacks Against Korean Companies (Andariel)

AhnLab SEcurity intelligence Center (ASEC) recently discovered a case where an unidentified threat actor exploited a Korean ERP solution to carry out an attack. After infiltrating the system, the threat actor is believed to have attacked the update server of a specific Korean ERP solution to take control of systems within the company. In another attack case, a vulnerable web server was attacked to distribute malware. The targets of these attacks have been identified as the Korean defense and manufacturing …

actor ahnlab andariel asec attack attacks case center companies control erp exploited intelligence malware malware analysis security security intelligence server solution system systems threat threat actor update xctdoor