Stolen Patch Management Credentials Used in Attack on South Korea

Last week, over 32,000 computer servers operated by South Korean financial institutions and broadcasters were compromised by a piece of malware.

Some reports have revealed that the attackers might have utilized a security hole in the products of AhnLab, a South Korean antivirus company whose solutions are used by many of the victims of the attack.

However, according to AhnLab, the attackers haven’t exploited a security hole in the company’s products to deliver the malicious code. Instead, they somehow obtained user IDs and passwords for patch management systems located on the affected networks.