Correction at 1220 KST on 11/5: This article has been updated to provide further clarification on how ESTsecurity detected the malware.

Malicious code identified on Friday by Kaspersky Lab was also hosted in the source code of a North Korea-affiliated news website, South Korean cyber-threat organization ESTsecurity told NK News.

The attack script named “Operation WizardOpium“, which Kaspersky Lab described as a “waterhole-style injection on a Korean-language news portal”, was embedded in the Arirang Meari news website, the Seoul-based ESTsecurity told local media on November 2.

Arirang Maeri is the official China-based website of North Korea’s Arirang Association