russia

South Korea’s financial sector has been hit by one of the most damaging cyberattacks in recent years. According to cybersecurity firm Bitdefender, the country became the target of a coordinated supply-chain attack involving threat actors linked to Russia and North Korea, resulting in the deployment of the Qilin ransomware and the theft of more than 2 terabytes of data across 28 victims, most of them within the financial services industry.
Investigators uncovered that the attack was not an isolated incident but part of a broad, multi-phase campaign known as Korean Leaks, which merged advanced ransomware techniques with political propaganda and targeted exploitation of supply-chain vulnerabilities.

A Sudden Spike: From 2 Incidents Per Month to 25 in September
Bitdefender began investigating after detecting an unusual surge in ransomware activity in September:

25 ransomware cases were reported that month, compared to the usual two monthly incidents recorded between September 2024 and August of this year.
Of these attacks, 24 targeted financial organizations, highlighting a high degree of planning and coordination.
According to the latest data, South Korea is now the second most targeted country in the world for ransomware attacks — trailing only the United States.

Qilin: One of 2024’s Most Aggressive Ransomware Groups
The ransomware group Qilin, operating under the Ransomware-as-a-Service model, is one of the most active threat actors of the year. In October alone, Qilin was responsible for more than 180 victims, and according to NCC Group, is behind 29% of all global ransomware attacks.
Bitdefender’s analysis indicates that Qilin has Russian roots:
founding member BianLian communicates in Russian and English,is active on Russian-language cybercrime forums,and the group avoids attacking organizations in CIS countries — a common rule among Russian cybercrime syndicates.
Qilin’s internal structure is highly organized:
it recruits external hackers to carry out attacks,core operators take a percentage of ransom payments,and the group even maintains an “internal journalist team” that drafts extortion messages and propaganda for its leak platform.
Propaganda and Psychological Warfare: Hackers Posed as “Activists”
Bitdefender’s Korean Leaks report reveals that the campaign was not a standard ransomware operation. The attackers blended cybercrime with political messaging, using:
activist-style language,patriotic and nationalistic rhetoric,and repeated references to sharing the stolen data with North Korean leadership.
One leaked communication stated:
“A report on the discovered documents is already being prepared for Comrade Kim Jong-un.”
This fusion of propaganda with ransomware tactics indicates a hybrid operation that goes beyond conventional criminal motives.

Three Attack Waves: Over 1 Million Files and 2 TB of Data Stolen
The Korean Leaks campaign unfolded in three distinct waves:
September 14 – first wave targeting 10 financial management firmsSeptember 17–19 – second wave adding another 9 victimsSeptember 28 – October 4 – third wave targeting 9 additional organizations
In total, the attackers stole over 1 million files and 2 TB of sensitive data.

Four additional company names were later removed from Qilin’s leak site, likely due to ransom payments or internal decisions by operators.
During the second wave, hackers issued a chilling threat:
“We have data that will deal a severe blow to the entire Korean market. If payment is not made, we will release it.”

Supply-Chain Breach: The Core Entry Point
According to reporting from JoongAng Daily, more than 20 asset-management companies were compromised after hackers breached GJTec, a managed service provider.

This highlights yet again how supply-chain attacks can amplify damage across an entire sector.

Conclusion: A Hybrid Operation Blending Russian Techniques and North Korean Messaging
The Korean Leaks attack ranks among the most significant ransomware operations of the year — not only due to the volume of stolen data, but also due to the hybrid nature of the campaign, which fused ransomware, political influence tactics, and systemic exploitation of supply-chain weaknesses.
Experts warn that this incident is a stark reminder of a growing global trend:

state-linked cyber groups are increasingly prioritizing supply-chain infiltration as a primary attack vector.

#cyberattack , #CyberSecurity , #russia , #GlobalSecurity , #CryptoNews

Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“