# Operation Red

Attackers compromised the update server of a remote support solutions provider 
to deliver malicious updates to targeted organizations in South Korea. 
The malicious update was signed using a valid certificate 
stolen from the remote support solutions provider 

Attackers first compromised the update server, 
then configured the server to only deliver malicious files if the client is 
located in the range of IP addresses of their target organizations.


## Imapct

N/A

## Type of compromise

It appears the attackers compromised the publishing infrastructure, 
as well as signing keys for updates.
