South Korean ERP Vendor's Server Hacked to Spread Xctdoor Malware

ASEC discovered that a South Korean ERP vendor's update server was compromised to deliver a Go-based backdoor (Xctdoor) which, when injected by XcLoader into legitimate processes via regsvr32-executed DLLs, can capture keystrokes, screenshots, and clipboard data and execute remote commands; communication with C2 uses HTTP with MT19937 and Base64 obfuscation. The report also links similar tactics to North Korea-associated clusters (Andariel/Lazarus, Kimusky) and describes additional phishing-driven campaigns (HappyDoor, Konni) targeting South Korea.