A digital certificate belonging to CJ OliveNetworks Co., the IT services subsidiary of South Korea’s CJ Group, has been leaked and exploited in a suspected North Korean cyberattack. The incident has raised new concerns about digital security infrastructure across South Korea’s public and private sectors.
Stolen Certificate Used in Targeted Espionage Attempt
The breach came to light in early May 2025, when CJ OliveNetworks’ digital signature was discovered embedded in a malicious file attributed to the North Korean state-sponsored hacking group Kimsuky. The file was believed to have been distributed in late April. In response, CJ OliveNetworks confirmed the breach, stating that the certificate – originally issued for software development and distribution – was revoked immediately after discovery and is no longer valid.
The RedDrip Team, a Chinese cybersecurity firm, reported that the stolen certificate had been used in an attempted attack on the Korea Institute of Machinery and Materials (KIMM), a South Korean research institution. There is no evidence at this time that the attack succeeded or that additional organizations were compromised.
CJ OliveNetworks has also reported the incident to the Korea Internet & Security Agency (KISA), which oversees national cybersecurity response coordination. This action underscores the severity of the breach and the risk posed by compromised code-signing credentials.
Kimsuky Tactics and National Cybersecurity Implications
Kimsuky, active since at least 2012, is known for espionage campaigns targeting South Korean government agencies, defense contractors, and academic institutions. The group frequently uses spear phishing and malicious payloads, including CHM and LNK files, to deploy backdoors and gather sensitive information. In this case, experts believe the attackers may have used the stolen certificate to disguise malware as legitimate software in order to bypass security defenses.
The incident comes amid a broader uptick in cyber intrusions targeting South Korean technology firms. In recent months, attackers also exploited vulnerabilities in SK Telecom’s USIM infrastructure. Digital certificates play a critical role in maintaining trust in software ecosystems by validating file authenticity and origin, and their misuse can enable sophisticated cyberattacks with far-reaching implications.
At this stage, there are no public indications that customers or end users of CJ OliveNetworks were directly affected. However, the breach has renewed calls for stronger digital certificate lifecycle management and more proactive cybersecurity strategies to counter increasingly advanced threat actors.
Sources: MK English News, Yonhap News
—
May 9, 2025 – by the ID Tech Editorial Team
