Ten South Korean organizations appeared on ransomware leak sites in the past seven days, according to IntelFusions incident tracking. Over the previous twelve weeks Korea averaged fewer than three a week, and outside one October spike the weekly count ran between zero and four. The best-known name in the new batch is Hyundai E&C.
These are unverified claims posted by the gangs themselves. None of the organizations named below has confirmed a breach in anything we have seen, and a leak-site listing is not proof that data was stolen.
Four Korean manufacturers in a single day
On November 7 the MetaEncryptor crew, which our database also tracks under the alias LostTrust, posted seven new victims. Four of them were Korean: Hyundai E&C, Daeah E&C, DAEWON Chemical and Wooshin Systems. The Hyundai E&C listing carries only a generic profile of Hyundai Motor Group, of which the construction company is a member, so it does not say which part of the group the crew claims to have reached. DAEWON Chemical's listing describes a maker of polyurethane synthetic leather and wallpaper founded in 1974, and Wooshin Systems' describes an automotive industry supplier founded in 1984. The Daeah E&C entry carries nothing beyond a name.
Korea is not new territory for this crew. Of the 34 MetaEncryptor claims in our data since late August, six are Korean, including industrial automation firm SFA Engineering in September and HyVision System, a maker of test equipment for mobile camera modules, later the same month. Japanese manufacturers Nippon Steel, Astemo and Corona also appear on its list. The crew tends to post in batches on a handful of days rather than a steady trickle, and before this week it had been quiet since October 12.
A new crew whose first victims are all Korean
The other half of the week came from a crew we had not seen before. OBSOFT made its first appearance on November 3 with five anonymous teasers, listed only as Company #1 to Company #5, every one of them tagged to South Korea. Two further anonymous entries carry no country at all. With no names or sectors, there is nothing to verify yet, and the country tags come from leak-site metadata that is often wrong. Crews that open with withheld names usually reveal them later if no payment arrives, so these entries may yet be named.
The second Korean spike in four weeks
This is not the first jump this autumn. The week of October 12 produced 16 Korean claims, almost all from N0n's sweep of port and shipping firms. That was one crew working through one sector. This week is different in shape: two unrelated crews, and a tilt toward manufacturing and the automotive supply chain rather than logistics.
Ask suppliers directly, then check the forgotten systems
South Korea is rated a critical-targeting country on its IntelFusions country profile, and its national CERT is KrCERT/CC. Organizations that buy from or share network access with the firms named here should ask them directly rather than wait for a disclosure, and rotate any shared credentials or VPN accounts. With two unrelated crews and no published indicators, there is no single thing to hunt for. Patching internet-facing systems, multi-factor authentication on every remote access path, and offline, tested backups do most of the work, and AhnLab's recent finding that Korean and Japanese breaches began at forgotten side systems is a reminder to include the servers nobody remembers owning.
One week of claims is a signal, not a census. Two Korean surges in a month, from crews with nothing obvious in common, is a better reason for Korean manufacturers and their suppliers to assume they are on more than one target list.
This briefing is provided by IntelFusions for informational and defensive purposes only. It summarizes extortion claims published by ransomware leak sites. Those claims are made by the attackers, are unverified, and may be false, exaggerated, or recycled from earlier breaches. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.