SANDS Lab warns of widespread Korean corporate data leaks from emails impersonating intellectual property infringement notices

SANDS Lab warns of widespread Korean corporate data leaks from emails impersonating intellectual property infringement notices

• Victim list obtained from attackers’ Telegram channel includes major Korean companies and institutions
• Infostealer and Purehvnc RAT combination raises warnings of possible penetration into internal corporate networks
• Infections continue to rise in Korea, highlighting the need for NDR products and personal information breach search services

Photo 1. The malware distribution analysis report published by SANDS Lab

Malicious emails posing as intellectual property infringement notices have been found to be circulating indiscriminately among Korean companies and institutions. AI security specialist SANDS Lab published a report on the 9th confirming that this cyber threat had infected approximately 200 systems in Korea alone, including those at more than 13 major companies, institutions, universities and associations.

The malicious emails contain links disguised as documents such as “Evidence for an Intellectual Property Infringement Investigation.pdf,” “Investigation Report.pdf” and “Investigation Report Confirming Evidence of Violations.pdf.” If recipients click a link, download the file and run it, a multistage malware infection begins immediately.

Photo 2. The body of an actual malicious intellectual property email, designed to entice recipients to click the attached investigation report.

The attackers use a Python-based multistage loader to install an infostealer on the user’s PC and repeatedly decrypt additional payloads from an external server. This process leaks personal information such as browser data, IP addresses, installed antivirus software and cryptocurrency wallet information. Finally, Purehvnc RAT is installed, allowing the hackers to control the infected system at will.

SANDS Lab’s threat analysis team tracked the attackers’ Telegram channel and obtained a victim list, enabling a more precise assessment of the scale and scope of infections. The team also found that the malware goes beyond ordinary email phishing, using a sophisticated multistage infiltration strategy. Infections are increasing, with dozens or more new cases continuing to emerge each day on average.

SANDS Lab classified the campaign as a highly serious cyber threat because stolen personal information can be used to log in to other services, leading to secondary and tertiary harm such as leaks of internal corporate information. It recommended immediate security reviews and response measures: avoiding emails from unclear sources or those implying legal sanctions; promptly conducting forensic analysis and response if infection is suspected; and considering email security solutions or real-time threat response technologies.

Photo 3. Infection trends by country over time, showing Korea accounts for a substantial share.

Heo Su-man, head of SANDS Lab’s threat analysis team, said, “This is a sophisticated targeted attack that goes beyond ordinary spam. A malware infection can lead not only to stolen personal information but also to the loss of control over systems, potentially putting a company’s entire infrastructure at risk.” He added, “It is important to always delete suspicious emails without clicking them. Companies also need solutions such as NDR (network detection and response) to identify internal information leaks and respond proactively, and should use personal information breach search services to check for leaks.”

The full report, “Distribution of PureHVNC Malware through Copyright Impersonation Emails Targeting Korean Companies,” is available on SANDS Lab’s official blog (https://blog.naver.com/sandslab).