Lazarus_Group__2013__Dark_Seoul_Cyberattack_1.pdf

This report analyzes the March 20, 2013 Dark Seoul campaign that disrupted major South Korean banks and broadcasters by using spearphishing and a compromised website to deliver an Internet Explorer exploit (CVE-2012-1889), deploy downloaders and backdoors, perform local DNS poisoning for credential harvesting, and ultimately execute a cross-platform wiper (Trojan.Jokra) that overwrote MBRs and rendered systems unusable; the authors conclude the campaign caused high impact at scale (~48,000 infected machines) despite relatively low technical sophistication compared with contemporary APTs.