Andariel Threat Group Evolves to Target South Korean Entities with Custom Ransomware

The threat actor has been spreading the third stage payload from the middle of 2020 onwards and leveraged malicious Word documents and files mimicking PDF documents as infection vectors.