Lazarus Group Intensifies Attacks on South Korean Web Servers

Researchers have uncovered a series of highly sophisticated cyberattacks by the notorious Lazarus group, targeting web servers in South Korea.

The attackers have been infiltrating IIS servers to deploy ASP-based web shells, which serve as the first-stage Command and Control (C2) servers. These initial C2 servers act as intermediaries, relaying communications to secondary C2 infrastructure, allowing deeper penetration into compromised systems.

First identified in January 2025, these latest attacks showcase an advancement of similar methods observed in May 2024, highlighting the persistent and evolving strategies employed by this state-sponsored group. The Lazarus group has consistently exploited legitimate web servers to establish attack infrastructures, refining their approach over time.

According to the AhnLab Security Intelligence Centre (ASEC), the latest campaign involved the installation of multiple ASP-based web shells on vulnerable IIS servers. One notable addition is the modified version of the “RedHat Hacker” web shell, stored under the filename “function2.asp.” Unlike previous versions that used “1234qwer” as the authentication password, the latest variant now requires “2345rdx,” reflecting an enhancement in security measures.

Other deployed web shells, such as “file_uploader_ok.asp” and “find_pwd.asp,” grant the attackers extensi

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.