gom-player

GOM Player update mechanism abused to deliver malware to Korean targets

In mid-2013, suspected DPRK-aligned actors abused the auto-update mechanism of GOM Player — a popular Korean media player by Gretech — to deliver malware to selected South Korean targets. Compromised at the same broad period as SimDisk and other Korean software supply-chain incidents in the DarkSeoul cluster. The malicious update was served through GOM Player's official update channel and signed/packaged to appear legitimate. Public technical detail is sparser than for SimDisk; the incident is most often referenced in roundups of Korean software-update supply-chain compromises rather than a single canonical writeup.