Operation Double Barrel Exploits South Korean Financial Software

South Korean authorities and security researchers have identified a large-scale state-sponsored campaign, dubbed 'Operation Double Barrel,' that compromised over 72 organizations throughout 2025 and 2026. The attackers exploited vulnerabilities in locally installed financial security software, specifically AnySign4PC and related certificate-based signature tools, to achieve zero-click remote code execution. While primarily an espionage operation, significant technical overlaps in infrastructure and exploit chains were discovered between the state-sponsored group and Gunra ransomware-as-a-service (RaaS) affiliates.

The attack chain typically begins with watering hole sites—legitimate news, healthcare, and educational portals—where malicious JavaScript profiles visitors and triggers a buffer overflow in the security software over WebSocket. Once compromised, the systems are infected with variants of the SIGNBT (Struggle) or COPPERHEDGE (Brandoor) backdoors. These tools utilize advanced evasion techniques including in-memory PE loading, DLL side-loading, and encrypted registry-based configuration storage.

This campaign highlights a critical supply-chain risk where trusted security software required for standard financial and government transactions becomes the primary infection vector. Organizations in South Korea and those with domestic operations are urged to patch AnySign4PC to version 1.1.5.0 and monitor for anomalous behavior associated with certificate-management processes.