North Korean hackers broke into web servers in South Korea to control malware hidden in malicious PDF files, Google’s Cybersecurity Action Team has disclosed in a new report. 

While Google did not attribute the attack to a specific group, a security expert familiar with the incident told NK Pro that similarities in techniques and procedures suggest Lazarus was likely the culprit. 

According to the report published last week, the attackers emailed PDF attachments purporting to be a job description for a role at Samsung, and requested that recipients download and install a “Secure PDF