North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn

New research and a joint advisory indicate that North Korea’s Lazarus Group and the criminal Gunra ransomware operation ran parallel campaigns (2025–mid‑2026) against South Korean organizations by exploiting vulnerabilities in mandatory Korean financial security software; Lazarus implanted espionage backdoors in at least 72 organizations while Gunra used similar access to encrypt data and demand extortion payments.