RESEARCH indicates that North Korea's Lazarus Group has shared cyberattack tools with ransomware groups targeting South Korean entities. The findings, released alongside a joint advisory from four South Korean intelligence agencies, highlight that both Lazarus and the Gunra ransomware have launched parallel campaigns against South Korean organizations from 2025 to mid-2026.
Both groups exploited the same vulnerabilities in essential Korean financial software, with Lazarus installing espionage backdoors in numerous organizations, while Gunra focused on encrypting files and demanding ransoms. The report by AhnLab details these operations.