Baddies hijack Korean ERP vendor's update systems to spew malware

AhnLab reports that a South Korean ERP vendor's product update server was compromised to deliver a backdoor named Xctdoor via a modified ClientUpdater.exe which executes a DLL using Regsvr32. The activity is linked to Andariel (a Lazarus-affiliated group) and the malware can exfiltrate system information, execute remote commands, capture screenshots, log keystrokes and clipboard data. The intrusion represents a supply-chain style attack affecting ERP update infrastructure and targeted sectors include defense and other organizations; AhnLab urges heightened monitoring and patching of asset management programs.