KSystem ERP updater stole data

ASEC described a May 2024 attack against Korean companies in defense and manufacturing. The attacker appears to have abused a Korean ERP update server, then used the ERP update program as the trusted local execution path.

The changed program was ClientUpdater.exe. In the older 2017 pattern, Andariel inserted downloader logic into the ERP updater to fetch HotCroissant. In the 2024 case, ASEC saw a simpler routine that executed a DLL from a specific path with Regsvr32.exe.

The payload was Xctdoor, a Go DLL backdoor named from strings such as XctMain. It injected into processes including taskhost.exe, taskhostex.exe, taskhostw.exe, and explorer.exe, copied itself to an Edge package settings path as roaming.dat, and installed startup persistence.

This record stays scoped to the ERP update path. Public reporting did not prove a broad customer compromise or publish victim counts, but it did identify the affected mechanism, payload family, and Korean industrial target set.

Motive

Espionage Data Theft

Attribution

State

Cause

Server Compromise

Transitive

No

Actor

Andariel

Actor Country

North Korea

• KSystem security breach prevention vulnerability inspection guidanceblog.ksystem.co.kr
• Xctdoor Malware Used in Attacks Against Korean Companies (Andariel)asec.ahnlab.com