South Korea News: Qilin Ransomware Attacks the Financial Sector and Extracts Massive Data

The cybercriminal group Qilin has carried out one of the largest recent cyberattacks against the South Korean financial sector. By infiltrating a managed service provider (MSP), the attackers gained access to the systems of 28 financial institutions in the Asian country, compromising the security of one and a half million files as well as 2 terabytes of sensitive information.

The operation called “Korean Leaks”

The perpetrators named this malicious campaign “Korean Leaks” and executed it following a carefully planned three-stage strategy. The attack primarily targeted South Korean asset management and financial service companies, suggesting a particular interest in the country’s financial infrastructure.

Links to North Korean cybercriminals

The most concerning aspect of the incident is that cybersecurity experts have established potential links between this attack and the hacker collective Moonstone Sleet, allegedly connected to North Korea. This hypothesis adds an extra layer of severity to the event, implying possible geopolitical motivations behind the operation.

Blackmail and threats of disclosures

The criminals did not stop at demanding ransom for the stolen data. They also published information on specialized leak portals and threatened to reveal evidence of what they call “systemic corruption” and “signs of manipulation of the South Korean stock market.” This intimidation tactic aims to deliberately sow uncertainty and panic in South Korea’s financial markets, amplifying the impact of the attack beyond conventional data theft.

The incident highlights the growing sophistication and boldness of organized cybercriminals, as well as the vulnerability of financial infrastructure even in technologically advanced countries.