Lazarus_Group__2013__Dark_Seoul_Cyberattack.pdf

This paper analyzes the March 20, 2013 "Dark Seoul" attack that disrupted major South Korean banks and broadcasters, outlining a kill-chain from spearphishing and a compromised legitimate website to exploitation of CVE-2012-1889, deployment of backdoors and an infostealer, DNS poisoning to harvest credentials, and the Jokra wiper that overwrote MBRs and disks on thousands of machines; the authors conclude the operation caused high impact at large scale (>48,000 infected) despite being low in technical sophistication compared with known APT campaigns.