{ "response": [ { "Event": { "uuid": "40279790-6861-5d1d-b2f0-eaf5a0bed0c1", "info": "S. Korea, Belgium discuss leak of personal data of President Lee, Europe trip entourage", "date": "2026-11-12", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"belgium\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/s-korea-belgium-discuss-leak-of-personal-data-of-president-lee-europe-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261112009400315", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Nov 12, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. EU member states named: Belgium. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "1c798eeb-711e-5886-ac2a-27b51d553ea7", "info": "Virtual asset exchange Flybit hacked, resident registration numbers and tax information of 40 customers leaked", "date": "2026-11-12", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"crypto_theft\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Cryptocurrency\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/virtual-asset-exchange-flybit-hacked-resident-registration-numbers-and-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209490", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 12, 2026. Title machine-translated from Korean. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "4fa495ac-36d0-5e1d-8001-31d1616dc9e1", "info": "Financial Security Institute reports data leak following hacking attack", "date": "2026-11-10", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/incident-20261110-4/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147156", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261110010600315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261110010651315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209438", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147183", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209448", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209450", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 7 articles in 3 outlets (Boannews (Korean), Dailysecu (Korean), Yonhap), Nov 10 to Nov 12, 2026. Type: data breach; sectors: government, financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "6d10bffe-3813-5392-abaf-c644104cd87d", "info": "Phishing notification sent impersonating parking app 'Get your reward'... External agency breached", "date": "2026-11-10", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/phishing-notification-sent-impersonating-parking-app-get-your-reward-e-20261110/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147150", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Boannews (Korean)), Nov 10, 2026. Title machine-translated from Korean. Type: data breach; sectors: government, technology. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "6eb20c15-2e94-5172-8c2c-bb1d822f59b8", "info": "Mirae Asset says data breaches exposed customer, employee information", "date": "2026-11-06", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/mirae-asset-says-data-breaches-exposed-customer-employee-information-20261106/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261107000400315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261107000451315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10929242", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://ciso.economictimes.indiatimes.com/news/data-breaches/personal-info-of-39000-persons-leaked-from-mirae-asset-securities/135669047", "comment": "ETCISO (Economic Times)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 4 articles in 3 outlets (ETCISO (Economic Times), The Korea Herald, Yonhap), Nov 6 to Nov 9, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea, India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "info": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns", "date": "2026-11-05", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"Storm-0940\"" }, { "name": "misp-galaxy:country=\"hong kong\"" }, { "name": "misp-galaxy:country=\"cambodia\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"thailand\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/", "comment": "Check Point Research", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "comment": "Microsoft Threat Intelligence", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "146c35ff-de36-5c8d-8d30-3156bd41522c", "info": "Over 470,000 pieces of personal data leaked from 37 financial firms: FSC", "date": "2026-11-05", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/over-470000-pieces-of-personal-data-leaked-from-37-financial-firms-fsc-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261105002400320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/law-crime/20261105/over-470000-pieces-of-personal-data-leaked-from-37-financial-firms-fsc?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (Korea Times, Yonhap), Nov 5, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "19d01182-8092-5d15-a580-fa1c61784bf5", "info": "South Korea investigates 580 finance firms over data leaks, issues warning", "date": "2026-11-05", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/south-korea-investigates-580-finance-firms-over-data-leaks-issues-warn-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/week-asia/economics/article/3373363/south-korea-investigates-580-finance-firms-over-data-leaks-issues-warning", "comment": "South China Morning Post", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (South China Morning Post), Nov 5, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "78090cc0-ec70-5383-bd05-b8d09a7067e2", "info": "Data on 16,000 people compromised at 3 Seoul international schools in PowerSchool breach", "date": "2026-11-02", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Education\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/data-on-16000-people-compromised-at-3-seoul-international-schools-in-p-20261102/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10922866", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Nov 2, 2026. Type: data breach; sectors: education. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "1936f227-2555-556b-92d4-7f48f4860626", "info": "Binance TH pauses crypto transfers, says Thai funds safe after hack", "date": "2026-10-30", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"crypto_theft\"" }, { "name": "misp-galaxy:threat-actor=\"TraderTraitor\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"thailand\"" }, { "name": "misp-galaxy:sector=\"Cryptocurrency\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack", "comment": "The Thaiger", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/", "comment": "NK Pro", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-10-30/1068375", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://ec.ltn.com.tw/article/breakingnews/5624143", "comment": "Liberty Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000200315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000251315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000252315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4", "comment": "Japan Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921226", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261101000300315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-11-01/1068564", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921526", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261101de69102", "comment": "NHK", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921777", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261101000351315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance", "comment": "Free Malaysia Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975", "comment": "Taipei Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-11-02/1068750", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/", "comment": "NK Pro", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/", "comment": "NK News", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311", "comment": "Channel News Asia", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation", "comment": "Free Malaysia Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html", "comment": "VN Express", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261103de69881", "comment": "NHK", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 34 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 12, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea, Thailand. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "b67d48ad-cdf3-518c-b49d-661bcd4202fb", "info": "(LEAD) South Korean financial firms confirm data breach of customer data", "date": "2026-10-28", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/lead-south-korean-financial-firms-confirm-data-breach-of-customer-data-20261028/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261028002751320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 28, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a68f78aa-d5fa-5a5f-a8e7-521e5f41a6c0", "info": "Cyberattack wave widens across Korean financial sector", "date": "2026-10-28", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/cyberattack-wave-widens-across-korean-financial-sector-20261028/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10917639", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 28, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "4231ab55-afda-5056-8c62-4cdbc68dc149", "info": "KB Kookmin Bank finds 2,091 more people affected by data leak", "date": "2026-10-26", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/kb-kookmin-bank-finds-2091-more-people-affected-by-data-leak-20261026/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261026010200315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10915394", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (The Korea Herald, Yonhap), Oct 26, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "3117d446-07fc-5cac-b4a4-9d4df3f2dced", "info": "Yonsei Univ. portal hack leaks data of 10,000 students, graduates", "date": "2026-10-22", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Education\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/yonsei-univ-portal-hack-leaks-data-of-10000-students-graduates-20261022/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261022003300315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/education/20261022/yonsei-university-portal-hack-leaks-data-of-10000-students-graduates?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (Korea Times, Yonhap), Oct 22, 2026. Type: data breach; sectors: education. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "39a545b7-cdf8-58b1-bd4d-bb1335c83983", "info": "AI makes cyberattacks cheaper, harder to ignore: Cloudflare executive", "date": "2026-10-19", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/ai-makes-cyberattacks-cheaper-harder-to-ignore-cloudflare-executive-20261019/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10907396", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 19, 2026. Type: other; sectors: technology. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "96ac254c-4bea-5df2-a746-5f42e95e5e1d", "info": "Top bank chiefs face grilling over cyberattacks", "date": "2026-10-18", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/top-bank-chiefs-face-grilling-over-cyberattacks-20261018/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10906198", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 18, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "6221fecc-3d64-5ef6-a6ef-a1f25237b97b", "info": "Personal info presumed to have leaked from 16 financial institutions: regulator", "date": "2026-10-14", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/personal-info-presumed-to-have-leaked-from-16-financial-institutions-r-20261014/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261014006900320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 14, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "d6468d56-d3a3-50ad-b9e9-c5ab7907faa9", "info": "AI-powered attacks on Korean financial sectors linked to Chinese DDoS group: report", "date": "2026-10-11", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"ddos\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/ai-powered-attacks-on-korean-financial-sectors-linked-to-chinese-ddos-20261011/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10898597", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 11, 2026. Type: ddos; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "27acc24b-612d-5aeb-8722-ac242eefbaeb", "info": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks", "date": "2026-10-07", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/online-only-lenders-kakaobank-and-kbank-are-latest-targets-of-cyberatt-20261007/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_business/1281364.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Hankyoreh), Oct 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a8b50939-898c-5419-aafa-598548ea4742", "info": "Multiple IPs used to hide origin of recent cyberattacks against financial firms", "date": "2026-10-07", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/multiple-ips-used-to-hide-origin-of-recent-cyberattacks-against-financ-20261007/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261007005000315", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 7, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "e01e2aec-e24c-5526-9de9-ab86e8f61f14", "info": "19 IP addresses behind recent hacking attacks against Korean financial institutions: watchdog", "date": "2026-10-06", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"intrusion\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/19-ip-addresses-behind-recent-hacking-attacks-against-korean-financial-20261006/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261006005000320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261006005051320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/law-crime/20261006/19-ip-addresses-behind-recent-hacking-attacks-against-korean-financial-institutions-watchdog?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/law-crime/20261006/28-ip-addresses-behind-recent-hacking-attacks-against-korean-financial-institutions-watchdog?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261009003600315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261009003651315", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 6 articles in 2 outlets (Korea Times, Yonhap), Oct 6 to Oct 9, 2026. Type: intrusion; sectors: government, financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "61ace89f-32c9-5427-9f54-e7a8c1c953fa", "info": "Lee calls for thorough probe into personal data leaks at financial institutions", "date": "2026-10-04", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/lee-calls-for-thorough-probe-into-personal-data-leaks-at-financial-ins-20261004/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261004002100315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10892927", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261004002151315", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 3 articles in 2 outlets (The Korea Herald, Yonhap), Oct 4, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "f3551d60-9f23-534d-8f93-bea2091114c5", "info": "(2nd LD) Regulator instructs financial firms to check security systems over series of cyberattacks on banks", "date": "2026-10-02", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/2nd-ld-regulator-instructs-financial-firms-to-check-security-systems-o-20261002/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002009152320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 2, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "55a6564d-68e7-5cef-b137-2793678a5244", "info": "(LEAD) Some 25,000 customers' info leaked from Shinhan Bank in apparent AI agent-assisted hacking", "date": "2026-10-01", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/lead-some-25000-customers-info-leaked-from-shinhan-bank-in-apparent-ai-20261001/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261001006351320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10891104", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002004900320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002004951320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002009100320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10892290", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002009151320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 7 articles in 2 outlets (The Korea Herald, Yonhap), Oct 1 to Oct 2, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "e1a61d0d-4fce-5343-acc6-e7b20391bcc3", "info": "Nearly 4 in 10 S. Korean industrial technology leaks involve semiconductors: data", "date": "2026-09-27", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Manufacturing\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/nearly-4-in-10-s-korean-industrial-technology-leaks-involve-semiconduc-20260927/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20260927000800320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10885167", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (The Korea Herald, Yonhap), Sep 27, 2026. Type: data breach; sectors: manufacturing. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "91b0e4ed-1cae-581b-804b-aaed6cc8a5f8", "info": "North Korean 'ted' Linux Backdoor Found Inside Trojanised HAProxy at South Korean Firms", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"APT37\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Manufacturing\"" }, { "name": "misp-galaxy:sector=\"Media\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/north-korean-ted-linux-backdoor-found-inside-trojanised-haproxy-at-south-korean-firms/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Rapid7 Labs disclosed a previously undocumented Linux toolkit compiled directly into trojanised HAProxy 2.8.12 load balancers at two South Korean organisations in the automotive and media sectors. The 'ted' implant and companion 'curlRAT' were delivered by replacing legitimate binaries, including crond, sshd, agetty, atd and polkitd, rather than through vulnerability exploitation, allowing web traffic interception, encrypted SSH credential harvesting and log sanitisation. Rapid7 attributed the activity with medium confidence to North Korean state-sponsored actors, drawing on APT37 domain infrastructure, Lazarus delivery-model similarities and a Kimsuky-consistent initial access hypothesis involving a compromised groupware vendor.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a33a801c-155e-55ff-a042-ba68fbef2d44", "info": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"australia\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Technology\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Healthcare\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "98ed5a28-001f-5c9c-be72-67b4f6d8f172", "info": "North Korea-linked backdoor found compiled inside HAProxy at two South Korean companies", "date": "2026-09-01", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"APT37\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Automotive Manufacturing\"" }, { "name": "misp-galaxy:sector=\"Media and Broadcasting\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/north-korea-linked-backdoor-found-compiled-inside-haproxy-at-two-south-korean-companies/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cyfirma.com/news/weekly-intelligence-report-11-sep-2026/", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Rapid7 Labs disclosed that DPRK-aligned operators compiled a backdoor named 'ted' directly into the victims' existing HAProxy 2.8.12 load balancers using native HAProxy filter APIs, accompanied by a tool named curlRAT and trojanised crond, agetty, atd, sshd and polkitd daemons. C2 mode was triggered by a request for a decoy image path, after which commands were passed via named pipes and the requests were erased from HAProxy logs and statistics without ever reaching the backend. Two South Korean companies in the automotive and media sectors were confirmed affected, with capabilities including credential harvesting, SSH keylogging, session cookie theft and fingerprint-matched drive-by injection. Attribution to APT37 is medium confidence, with possible Lazarus Group overlap.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "555c9614-2fc1-5b9c-9a58-8d1170ae14cd", "info": "SafePay Ransomware Claims Air Liquide Korea", "date": "2026-08-25", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"ransomware\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"manufacturing\"" }, { "name": "misp-galaxy:sector=\"chemicals\"" }, { "name": "misp-galaxy:sector=\"industrial gases\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/safepay-ransomware-claims-air-liquide-korea/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.ransomware.live/id/aW5kdXN0cnkuYWlybGlxdWlkZS5rckBzYWZlcGF5", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "The SafePay ransomware group listed industry.airliquide.kr, the Korean industrial-gases arm of Air Liquide, on its leak site on 25 August 2026. Air Liquide Korea supplies essential gases to major South Korean industries including semiconductor manufacturing; SafePay operates a double-extortion model and had claimed over 530 victims globally by August 2026.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "4da37fa4-4d5d-55ac-a9b1-1036b696dc20", "info": "Lazarus Group Cryptocurrency Exchange Heist — Singapore", "date": "2026-04-28", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"apt\"" }, { "name": "misp-galaxy:threat-actor=\"Lazarus Group\"" }, { "name": "misp-galaxy:country=\"singapore\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Cryptocurrency\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/lazarus-group-cryptocurrency-exchange-heist-singapore/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": { "title": "FBI Flash Alert", "url": "https://www.ic3.gov/" }, "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": { "title": "Chainalysis Reactor Analysis", "url": "https://www.chainalysis.com/blog/" }, "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Lazarus Group (DPRK) executed a sophisticated supply-chain compromise of a cryptocurrency custodial platform based in Singapore, stealing approximately USD 230 million in mixed crypto assets. The attack chain involved compromising a third-party trading SDK used by the exchange, injecting malicious transaction-signing code. FBI and MAS (Monetary Authority of Singapore) issued joint alert. Funds traced through Tornado Cash and cross-chain bridges to DPRK-linked wallets.", "comment": "summary", "to_ids": false } ] } } ] }