Ulose — Ransomware Profile
Ulose is an extortion crew that runs a Tor data-leak site and has so far named only South Korean organisations. ZDNet Korea, reporting in late September 2026, called it a new ransomware operation first identified in June 2026 and placed it among the groups tied for second behind Qilin for Korean victims this year, at five listings each, noting that such tallies count organisations a group registers on its leak site rather than confirmed breaches. AhnLab's ASEC recorded in its dark web roundup for the first week of October 2026 that Ulose claimed a data leak at a South Korean general hospital. The ransomware.live and SOCRadar trackers each show a single affected country, and ransomware.live records claims across financial services, healthcare and manufacturing. At least six listings have appeared, the most recent in late September 2026, and SOCRadar records all of them as claims.
Recent claimed victims
Read the full analysis on IntelFusions