“Watering hole” attacks aim to compromise website visitors, typically through plug-ins or browser vulnerabilities. In this case, a well known threat group associated with the government of North Korea appears to be targeting citizens in South Korea who use online banking services or online government services. The most critical portion of these attacks lies in the compromising of the webservers and the code-signing checks. While code-signing can be an essential aspect in determining a file’s integrity, it is not the end. Preventive measures to avoid things such as namespace conflicts by verifying the file hashes instead, as ESET mentioned, can be the extra step needed to prevent attacks such as this. Watering hole attacks are often used by the Lazarus group and will likely not end any time soon. Any government or business organization that requires website visitors to install plug-ins or other software should take care not to introduce additional vulnerabilities through the required software.

References:
https://www.zdnet.com/article/lazarus-malware-strikes-south-korean-supply-chains/
https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/