Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This comprehensive analysis covers cyber threats targeting financial companies in Korea and globally. It examines malware and phishing cases, top 10 malware strains, and statistics on leaked Korean accounts. The report delves into major financial threats on the dark web, including credit card data breaches, database breaches, and ransomware attacks. A notable case involves the Arkana ransomware group's breach of a global online brokerage firm, In***, resulting in the theft of 50 GB of customer data, including KYC submissions and information of over 163,000 customers. The incident highlights vulnerabilities in trading platforms' identity verification and account protection systems, emphasizing the need for enhanced security measures beyond regulatory compliance.

The May 2025 Security Issues campaign highlights a series of cyber threats targeting financial institutions primarily in South Korea but with global implications. The campaign details multiple attack vectors including malware infections, phishing campaigns, and ransomware attacks, with a focus on the financial sector. Key malware strains are identified among the top 10 most prevalent, contributing to data breaches and account compromises. A significant incident involved the Arkana ransomware group breaching a global online brokerage firm, resulting in the theft of approximately 50 GB of sensitive customer data. This data included Know Your Customer (KYC) submissions and personal information of over 163,000 customers, exposing critical vulnerabilities in identity verification and account protection mechanisms within trading platforms. The campaign also discusses the presence of stolen financial data on the dark web, including credit card and database breaches, which facilitate identity theft and fraud. The threat actors employ a range of tactics, techniques, and procedures (TTPs) such as ransomware deployment (T1486), data destruction (T1489), credential access (T1078), phishing (T1566), and command and control communications (T1071). The campaign underscores that existing regulatory compliance measures are insufficient to mitigate these risks, emphasizing the need for enhanced security controls tailored to the unique challenges of financial services platforms. Indicators of compromise include multiple malware hashes linked to the Arkana group and associated ransomware families like LockBit. Although no known exploits in the wild are reported, the campaign reflects ongoing and evolving threats to financial institutions' confidentiality, integrity, and availability of data and services.

Detailed information about May 2025 Security Issues in Korean & Global Financial Sector. Get real-time updates, technical details, and mitigation strategies.

May 2025 Security Issues in Korean & Global Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

May 2025 Security Issues in Korean & Global Financial Sector

A breach of LockBit's dark web affiliate panels exposed a rare glimpse into their operations. The leaked data included Bitcoin addresses, admin credentials, and a chat log revealing negotiation tactics and ransom demands. Ransom amounts varied widely, with some victims confused about the demands. The breach exposed LockBit's research into victims' finances and their willingness to provide additional services for a fee. The incident highlights the complexities of cybercrime negotiations and the human stories behind the headlines. Additionally, Cisco Talos observed a trend of attack kill chains being split into two stages, executed by separate threat actors, leading to refined definitions of initial access brokers.

The recent breach of LockBit's dark web affiliate panels provides an unprecedented insight into the operational mechanics of one of the most prolific ransomware groups. LockBit operates through an affiliate model, where independent threat actors gain access to ransomware tools and infrastructure to conduct attacks, sharing profits with the core group. The leaked data includes Bitcoin addresses used for ransom payments, administrative credentials for the affiliate panels, and chat logs that reveal negotiation tactics and ransom demand strategies. Notably, ransom demands vary significantly, sometimes causing confusion among victims, which indicates a flexible but complex negotiation process tailored to each victim's perceived ability to pay. The breach also exposed LockBit's internal research into victims' financial situations, suggesting a targeted approach to maximize ransom yields. Furthermore, LockBit offers additional paid services, such as data leak site management and victim support, indicating a sophisticated criminal business model. Cisco Talos' observations of attack kill chains being split into two stages, executed by separate threat actors, highlight an evolution in ransomware operations. This division of labor refines the role of initial access brokers, who specialize in gaining entry to networks and then selling or handing off access to ransomware affiliates. The technical indicators provided, including multiple file hashes, can assist defenders in identifying related malware or tools used by LockBit affiliates. Overall, this breach sheds light on the human and operational complexities behind ransomware campaigns, emphasizing the importance of understanding adversary tactics beyond technical exploits.

Detailed information about Unfiltered look into LockBit’s operations. Get real-time updates, technical details, and mitigation strategies.

Unfiltered look into LockBit’s operations - Live Threat Intelligence - Threat Radar | OffSeq.com

Unfiltered look into LockBit’s operations

This intelligence update covers recent cybersecurity events. In positive developments, global authorities disrupted a major botnet, arrested a ransomware actor, and dismantled a dark web marketplace. On the negative side, a malicious NPM package was discovered hiding multi-stage malware using Unicode and Google Calendar. The most concerning development involves cyberspies exploiting a zero-day vulnerability in Output Messenger to target Kurdish military users in Iraq, showcasing increased capabilities of the Marbled Dust threat group.

This intelligence update highlights multiple cybersecurity events, with a particular focus on a zero-day vulnerability identified as CVE-2025-27920 in Output Messenger, a communication platform. The vulnerability is actively exploited by the Marbled Dust threat group, a known cyberspy actor, targeting Kurdish military users in Iraq. Output Messenger is used for internal communications, and the exploitation involves malicious binaries such as omclientservice.exe and omserverservice.exe, indicating compromise of client and server components. The attack leverages this zero-day to gain unauthorized access, likely enabling espionage activities such as data exfiltration or command and control. The threat actor's use of this zero-day demonstrates advanced capabilities and targeted intent. Additionally, the update mentions a malicious NPM package employing multi-stage malware with obfuscation techniques using Unicode and Google Calendar, as well as disruptions of botnets, ransomware actors, and dark web marketplaces. However, the zero-day exploitation in Output Messenger is the most concerning due to its targeted nature and potential for persistent espionage. No patch or mitigation is currently available for CVE-2025-27920, and no known exploits in the wild beyond the targeted attacks have been reported. The presence of domain indicators such as api.wordinfos.com may relate to command and control infrastructure or malware communication channels. Overall, this threat represents a sophisticated supply chain and communication platform compromise with significant espionage implications.

Detailed information about The Good, the Bad and the Ugly in Cybersecurity – Week 20. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'dark web'

Filter Threats

Threats Tagged 'dark web'