South Korean police have confirmed they are investigating a hacking campaign that reached 102 domestic institutions, including news outlets, pharmaceutical companies and hospitals, with stolen data reportedly including personal information and phone numbers belonging to senior government figures. The National Investigation Headquarters (NIH) of the Korean National Police Agency disclosed the investigation in a public notice on August 20, 2026, according to Seoul Economic Daily, the only source in this set reporting the Korean case directly. Investigators have traced part of the intrusion to a private certification authority server compromised in February 2026, and are leaning toward attribution to Lazarus, the North Korean group operating under the Reconnaissance General Bureau, based on malware code similarities. Police have explicitly stated that further verification is needed before attribution is conclusive.
What Happened
Per Seoul Economic Daily's account of the NIH notice, police are investigating a cluster of compromises spanning a news outlet's server management firm, pharmaceutical companies and hospitals. The total affected institution count is reported at 102. The caseload is distributed: some cases sit with the Seoul Metropolitan Police Agency, while the NIH has assigned the certification authority case to Busan Police.
The most politically sensitive element is the February 2026 breach of a private certification authority. Police assess that attackers stole personal information on prominent domestic figures, including a senior Presidential Office official, from a server operated by a private firm rather than from any internal Presidential Office system. A Presidential Office representative said the same day that its own server was not directly hacked. That distinction matters operationally: it is a third-party and supply-chain compromise, not a direct breach of the executive network.
Readers should note the sourcing limits here. The 102 figure, the Lazarus lean, and the Presidential Office detail all trace to a single OTHER-tier outlet reporting on a police notice. No national CERT advisory, no victim statement, and no vendor report in this source set independently corroborates the Korean incident. The Check Point research, BleepingComputer, Infosecurity Magazine, SC Media and Help Net Security coverage in this set all concern a separate, concurrent Lazarus operation targeting defense and aerospace firms in Europe and India. Treat the Korean case and the Dream Job wave as related by actor, not as confirmed parts of one operation.
What Was Taken
Reporting on the Korean incident is thin on volume. Seoul Economic Daily describes the stolen material as personal information belonging to prominent domestic figures, with the incident framing specifying phone numbers of high-level government officials among the leaked data. No record count, no data-category inventory and no per-institution breakdown has been published across the available sources. Anyone citing a specific number for this breach is going beyond what has been reported.
The sensitivity is disproportionate to the volume. Direct contact details for senior officials are prime raw material for follow-on social engineering, SIM-swap targeting, and mobile-focused surveillance operations, which is consistent with a Reconnaissance General Bureau collection mission rather than a financially motivated one. A certification authority is also an unusually high-value node: it holds identity-linked records for many downstream relying parties, which is likely why it was targeted rather than the Presidential Office directly.
For the parallel Dream Job campaign, Check Point reports the objective was persistent access to defense-sector targets, with Infosecurity Magazine noting targeting of organizations working on surveillance sensors, drones and robotics, and activity or targeting spanning France, Germany, Brazil and India. WIRED separately reports that a security researcher who spent nearly two years inside systems belonging to a group of North Korean hackers found breaches across hundreds of networks worldwide, an independent data point on scale that suggests both the Korean and European clusters are fragments of a much larger operation.
Why It Matters
Three things stand out for defenders.
First, the entry point was an identity provider, not the ultimate target. Compromising a certification authority gives an attacker a lateral path into every institution that trusts it, and it lets the operator collect on protected persons without ever touching a hardened government network. The Presidential Office statement that its own server was not hacked is accurate and beside the point.
Second, the breadth of victim sectors, from hospitals to pharmaceutical firms to media infrastructure providers, indicates opportunistic exploitation of shared service providers rather than 102 individually selected targets. A single managed service or certification provider can account for a large share of that number.
Third, the concurrent Check Point research shows what this actor brings to bear when it wants a specific target. Check Point Research confirms Lazarus burned a Windows zero-day, CVE-2026-68820, in the same period. BleepingComputer reports Microsoft flagged the flaw as actively exploited in its August Patch Tuesday, and Infosecurity Magazine notes it was the only vulnerability in that release marked under active exploitation, with Check Point disclosing to Microsoft on July 28 and publishing on August 11. Timelines differ slightly across outlets, with BleepingComputer dating exploitation from early July and Check Point dating the wider campaign wave to early 2026. SC Media quotes Denis Calderone, CTO at Suzu Labs, observing this is at least the third time in two years Lazarus has exploited a built-in Windows driver flaw to deploy FudModule, following CVE-2024-21338 in appid.sys and an earlier AFD.sys issue.
The Attack Technique
The Korean intrusion method has not been published. Police cite malware code similarities to prior Lazarus tooling as the basis for their working attribution, but no infection chain, initial access vector or malware family has been named for the 102-institution cluster.
The Dream Job tradecraft documented by Check Point is well characterised and is the best available proxy for this actor's current capability. Attackers pose as recruiters offering roles at recognisable firms, with Help Net Security noting one decoy used a Lockheed Martin job description, and Check Point unable to confirm the initial approach channel but assessing LinkedIn or messaging apps based on prior waves. Check Point identified two parallel infection chains. In the DLL sideloading chain described by SC Media and Help Net Security, the victim receives an encrypted archive containing a legitimate signed PDF viewer (SmartaPDF.exe), a malicious DLL (libmupdf.dll), and an encrypted payload with a PDF extension. Launching the viewer sideloads the DLL, which displays a decoy document while executing the MISTPEN in-memory downloader. The second variant, per Check Point Research, distributes SecurityPDF, a modified PDF viewer that opens attacker-crafted documents and executes a new backdoor Check Point names Troy.
MISTPEN communicates through attacker-controlled files on OneDrive via the Microsoft Graph API, running reconnaissance and persistence modules before fetching a privilege escalation component. Infosecurity Magazine details the exploit delivery handshake: the module fingerprints the host, requests four public keys from the C2, generates fresh key material using Kyber/ML-KEM (the NIST post-quantum key encapsulation standard), and receives the exploit encrypted for in-memory execution, with a GOST-CBC layer on top of MISTPEN's own AES transport. That is a state actor engineering against future traffic decryption.
The payload is FudModule v3.1, Lazarus's kernel-mode rootkit. Per Infosecurity Magazine it disables telemetry callbacks, removes minifilters, kills the NT Kernel Logger and blinds 94 ETW providers, with newly added Smart App Control tampering that resets policy state and forces a code integrity reload. BleepingComputer reports the exploit specifically supported Windows 11 builds 26100 and 26200.
Infrastructure is borrowed rather than owned. Check Point reports Lazarus exploited CVE-2025-49113 in Roundcube webmail servers and planted RelayShell, a PHP webshell converting compromised hosts into C2 relay nodes. In at least one case a compromised organization was used to launch spear-phishing at further targets, trading on its reputation. BleepingComputer identifies that organization as being in France.
What Organizations Should Do
-
Patch CVE-2026-68820 immediately across all Windows 11 estates, prioritising builds 26100 and 26200. It was the sole actively exploited flaw in Microsoft's August 2026 Patch Tuesday. Separately, audit for CVE-2025-49113 on any internet-facing Roundcube instance and hunt for PHP webshells consistent with RelayShell.
-
Treat certification authorities, identity providers and managed service vendors as tier-zero assets. Inventory every third party holding identity-linked records on your personnel, demand evidence of their monitoring coverage, and assume a compromise there is a compromise of you. The Korean case shows an executive network can be exposed without being touched.
-
Monitor for EDR blinding rather than just malware. FudModule's purpose is to make itself invisible. Alert on ETW provider disablement, minifilter unload events, NT Kernel Logger termination and unexpected Smart App Control policy resets. Ship telemetry off-host in real time so a rootkit cannot retroactively silence it.
-
Baseline and alert on Microsoft Graph API and OneDrive traffic from endpoints that have no business reason for it. MISTPEN hides C2 inside sanctioned cloud services, which defeats domain reputation controls entirely.
-
Block DLL sideloading paths. Enforce application allowlisting that validates loaded module signatures, not just executable signatures, since the parent binary in this chain is legitimately signed. Restrict execution from user-writable archive extraction directories.
-
Brief staff in defense, aerospace, government and research roles on recruiter-themed lures specifically, and give them a fast, no-blame channel to report suspicious approaches on LinkedIn and messaging apps. Extend that guidance to trusted partners, given at least one confirmed case of a compromised organization being used to phish its own contacts.
-
If you operate in South Korea, contact the NIH or the relevant regional police agency if you suspect involvement, and independently review authentication logs back to at least February 2026 given the certification authority timeline.
Sources: North Korea-Linked Hackers Breach 102 Korean Institutions - Seoul E... | Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack -... | State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day... | Lazarus hackers exploited Windows zero-day to target defense firms | Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day - Infose... | DPRK’s Lazarus Group exploits Windows zero-day in backdoor campaign... | Lazarus hackers pair fake job offers with Windows zero-day exploit... | A Security Pro Hacked North Korean Hackers. He Found They’d Breache...