Threats Affecting South Korea
View all threats affecting or targeting South Korea. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
South KoreaThreats Affecting South Korea
Click on any threat for detailed analysis and mitigation recommendations
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors 0 A previously undocumented Linux toolkit has been targeting South Korean automotive and media organizations with minimal detection since early 2025. The campaign employs a HAProxy instance called ted backdoor, compiled within the victim's existing HAProxy version 2.8.12, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This sophisticated framework enables remote command execution, malicious script injection into web traffic, credential harvesting, and long-term surveillance. The ted backdoor uses HAProxy's native filter API and internal structures to intercept SSL-decrypted HTTP traffic while maintaining legitimate load balancing operations. Operating alongside are an SSH keylogger, a curl-based RAT with HAProxy health monitoring capabilities, and a deployment stager. The toolkit is attributed with medium confidence to DPRK APTs based on targeting patterns, simple XOR-based encryption schemes, custom substitution ciphers, and C2 infrastructure associated with APT37. Join the discussion | AlienVault OTX General | 09/04/2026, 16:53:57 UTC Added: 09/07/2026, 10:22:27 UTC |
Google warns of new Chrome zero-day flaw exploited in attacks 0 Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. [...] Join the discussion | Bleeping Computer | 09/04/2026, 11:48:17 UTC Added: 09/04/2026, 12:07:22 UTC |
Metabase 0.61.0 - Authenticated Remote Code ExecutionCVE-2026-59827 0 Metabase 0.61.0 - Authenticated Remote Code Execution Join the discussion | Exploit-DB RSS Feed | 09/03/2026, 00:00:00 UTC Added: 09/03/2026, 17:44:19 UTC |
SonicWall warns of actively exploited SMA1000 zero-day flaws 0 SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. [...] Join the discussion | Bleeping Computer | 09/02/2026, 06:39:29 UTC Added: 09/02/2026, 07:07:13 UTC |
Exploit-DB RSS Feed | 09/01/2026, 00:00:00 UTC Added: 09/01/2026, 17:59:45 UTC | |
Over 8,300 Gitea servers vulnerable to code execution attacks 0 Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. [...] Join the discussion | Bleeping Computer | 08/28/2026, 12:58:43 UTC Added: 08/28/2026, 13:22:21 UTC |
PaperCut warns of NG, MF flaw exploited in zero-day attacks 0 PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. [...] Join the discussion | Bleeping Computer | 08/27/2026, 16:31:53 UTC Added: 08/27/2026, 16:37:13 UTC |
Showing 1 to 7 of 7 results