Messy And Loud Hack In South Korea Doesn’t Look State Sponsored

A security researcher analyzed malware used in coordinated attacks on South Korean media and banks that executed at a preset time (2:00pm KST) and wiped Windows and Linux file shares; the campaign used infected email attachments, commercially available toolsets (including Gondad-related components), appears unsophisticated and noisy, and is judged unlikely to be state-sponsored.