Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This comprehensive analysis covers cyber threats and security issues affecting financial companies in South Korea and globally. It examines malware and phishing cases targeting the financial sector, including the top 10 malware strains and leaked Korean account statistics on Telegram. The report delves into dark web threats, focusing on credit card data breaches, financial institution database leaks, and ransomware attacks. Notable incidents include the M*** digital payment platform data breach in Indonesia, affecting 44 million users, and the Everest ransomware group's attack on J*** Bank in Jordan, compromising 11.7 GB of internal data. The analysis emphasizes the need for enhanced security measures, including real-time protection systems, account takeover detection, and strengthened internal defense mechanisms in the financial industry.

The June 2025 Security Issues report highlights a range of cyber threats targeting the financial sector in South Korea and globally, with a focus on malware, phishing, ransomware, and data breaches. The report identifies the top 10 malware strains affecting financial institutions and notes the leakage of Korean account statistics on Telegram, indicating active data exfiltration and potential credential abuse. Dark web activities are emphasized, particularly the trade and exposure of credit card data and financial institution database leaks. Noteworthy incidents include a massive data breach of a digital payment platform in Indonesia impacting 44 million users and a ransomware attack by the Everest group on a bank in Jordan, resulting in the compromise of 11.7 GB of internal data. The threat actors employ various tactics, techniques, and procedures (TTPs) such as data destruction (T1489), command and control communication (T1071), data from local system (T1005), data from network shared drive (T1567), exploitation for credential access (T1219), data encrypted for impact (T1486), and account takeover strategies. The report underscores the critical need for real-time protection systems, advanced account takeover detection, and robust internal defense mechanisms tailored for the financial sector to mitigate these evolving threats. Indicators of compromise (IOCs) include multiple malware hashes linked to these campaigns, although no known exploits are currently reported in the wild. The medium severity rating reflects the significant but not yet fully exploited threat landscape.

Detailed information about June 2025 Security Issues in Korean & Global Financial Sector. Get real-time updates, technical details, and mitigation strategies.

June 2025 Security Issues in Korean & Global Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

June 2025 Security Issues in Korean & Global Financial Sector

BERT Ransomware, active since March 2025, has expanded its operations to target both Windows and Linux environments. The group uses phishing for initial access and communicates via the dark web and Sessions for negotiations. Victims span multiple countries, primarily affecting service and manufacturing sectors. The Windows variant employs multiple file extensions and RSA encryption, while the Linux version shares code with Sodinokibi/REvil ransomware. A weaponized PowerShell script is used to disable security features before payload execution. The ransomware's infrastructure is linked to a Russian firm, suggesting potential ties to the region.

BERT Ransomware, active since March 2025, represents a sophisticated ransomware campaign targeting both Windows and Linux environments. The threat actors behind BERT employ phishing emails as their primary initial access vector, leveraging social engineering to trick users into executing malicious payloads. Once inside a network, the ransomware uses a weaponized PowerShell script to disable security features such as antivirus and endpoint detection and response (EDR) tools, facilitating unhindered payload execution. The Windows variant of BERT ransomware encrypts victim files using RSA encryption and appends multiple file extensions to encrypted files, complicating recovery efforts. The Linux variant shares significant code overlap with the notorious Sodinokibi/REvil ransomware, indicating possible code reuse or collaboration. Communication and ransom negotiations occur via dark web portals and the Sessions encrypted messaging platform, enhancing the attackers' anonymity and operational security. The ransomware primarily targets organizations in the service and manufacturing sectors across multiple countries. The infrastructure supporting BERT ransomware is linked to a Russian firm, suggesting potential geopolitical motivations or origin. Indicators of compromise include numerous file hashes associated with the ransomware binaries and two onion domains used for command and control or negotiation purposes. Although no known exploits are reported in the wild, the campaign's use of phishing and PowerShell-based disabling of defenses indicates a high level of operational sophistication and adaptability across different operating systems.

Detailed information about BERT RANSOMWARE - THE RAVEN FILE. Get real-time updates, technical details, and mitigation strategies.

BERT RANSOMWARE - THE RAVEN FILE - Live Threat Intelligence - Threat Radar | OffSeq.com

BERT RANSOMWARE - THE RAVEN FILE

This comprehensive analysis covers cyber threats targeting financial companies in Korea and globally. It examines malware and phishing cases, top 10 malware strains, and statistics on leaked Korean accounts. The report delves into major financial threats on the dark web, including credit card data breaches, database breaches, and ransomware attacks. A notable case involves the Arkana ransomware group's breach of a global online brokerage firm, In***, resulting in the theft of 50 GB of customer data, including KYC submissions and information of over 163,000 customers. The incident highlights vulnerabilities in trading platforms' identity verification and account protection systems, emphasizing the need for enhanced security measures beyond regulatory compliance.

The May 2025 Security Issues campaign highlights a series of cyber threats targeting financial institutions primarily in South Korea but with global implications. The campaign details multiple attack vectors including malware infections, phishing campaigns, and ransomware attacks, with a focus on the financial sector. Key malware strains are identified among the top 10 most prevalent, contributing to data breaches and account compromises. A significant incident involved the Arkana ransomware group breaching a global online brokerage firm, resulting in the theft of approximately 50 GB of sensitive customer data. This data included Know Your Customer (KYC) submissions and personal information of over 163,000 customers, exposing critical vulnerabilities in identity verification and account protection mechanisms within trading platforms. The campaign also discusses the presence of stolen financial data on the dark web, including credit card and database breaches, which facilitate identity theft and fraud. The threat actors employ a range of tactics, techniques, and procedures (TTPs) such as ransomware deployment (T1486), data destruction (T1489), credential access (T1078), phishing (T1566), and command and control communications (T1071). The campaign underscores that existing regulatory compliance measures are insufficient to mitigate these risks, emphasizing the need for enhanced security controls tailored to the unique challenges of financial services platforms. Indicators of compromise include multiple malware hashes linked to the Arkana group and associated ransomware families like LockBit. Although no known exploits in the wild are reported, the campaign reflects ongoing and evolving threats to financial institutions' confidentiality, integrity, and availability of data and services.

Detailed information about May 2025 Security Issues in Korean & Global Financial Sector. Get real-time updates, technical details, and mitigation strategies.

May 2025 Security Issues in Korean & Global Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

May 2025 Security Issues in Korean & Global Financial Sector

A breach of LockBit's dark web affiliate panels exposed a rare glimpse into their operations. The leaked data included Bitcoin addresses, admin credentials, and a chat log revealing negotiation tactics and ransom demands. Ransom amounts varied widely, with some victims confused about the demands. The breach exposed LockBit's research into victims' finances and their willingness to provide additional services for a fee. The incident highlights the complexities of cybercrime negotiations and the human stories behind the headlines. Additionally, Cisco Talos observed a trend of attack kill chains being split into two stages, executed by separate threat actors, leading to refined definitions of initial access brokers.

The recent breach of LockBit's dark web affiliate panels has provided an unprecedented insight into the operational mechanics of one of the most prolific ransomware groups. LockBit operates on an affiliate model, where independent threat actors gain access to ransomware tools and infrastructure to conduct attacks, sharing profits with the core group. The leaked data includes Bitcoin addresses used for ransom payments, administrative credentials for affiliate panels, and chat logs revealing negotiation tactics and ransom demand strategies. These ransom demands vary widely, sometimes causing confusion among victims, indicating a flexible and complex negotiation process tailored to each victim's perceived ability to pay. The breach also exposed LockBit's internal research into victims' financial situations, suggesting a targeted approach to maximize ransom yields. Additionally, LockBit offers ancillary paid services such as data leak site management and victim support, reflecting a sophisticated criminal business model.

Cisco Talos has observed an evolution in ransomware operations, with attack kill chains being split into two stages executed by separate threat actors. This division refines the role of initial access brokers, who specialize in gaining network entry and then selling or handing off access to ransomware affiliates. This operational separation complicates detection and response efforts. The technical indicators provided, including multiple file hashes, can assist defenders in identifying related malware or tools used by LockBit affiliates. Overall, this breach sheds light on the human and operational complexities behind ransomware campaigns, emphasizing the importance of understanding adversary tactics beyond mere technical exploits.

Detailed information about Unfiltered look into LockBit’s operations. Get real-time updates, technical details, and mitigation strategies.

Unfiltered look into LockBit’s operations - Live Threat Intelligence - Threat Radar | OffSeq.com

Unfiltered look into LockBit’s operations

This intelligence update covers recent cybersecurity events. In positive developments, global authorities disrupted a major botnet, arrested a ransomware actor, and dismantled a dark web marketplace. On the negative side, a malicious NPM package was discovered hiding multi-stage malware using Unicode and Google Calendar. The most concerning development involves cyberspies exploiting a zero-day vulnerability in Output Messenger to target Kurdish military users in Iraq, showcasing increased capabilities of the Marbled Dust threat group.

This intelligence update highlights a sophisticated cybersecurity threat involving a zero-day vulnerability identified as CVE-2025-27920 in Output Messenger, a communication platform widely used for internal organizational communications. The vulnerability is actively exploited by the Marbled Dust threat group, a known cyberspy actor, targeting Kurdish military users in Iraq. The exploitation involves malicious binaries such as omclientservice.exe and omserverservice.exe, indicating compromise of both client and server components of the messaging platform. This zero-day allows attackers to gain unauthorized access, enabling espionage activities including data exfiltration, command and control, and persistent access within targeted environments. The attack demonstrates advanced capabilities and a targeted intent by Marbled Dust, emphasizing the threat’s sophistication and potential for long-term compromise.

Additionally, the update reports a malicious NPM package discovered that hides multi-stage malware using obfuscation techniques involving Unicode and Google Calendar, posing a significant supply chain risk to software development environments. This malware could lead to infections, data theft, or lateral movement within networks, especially affecting development pipelines relying on NPM packages.

While positive developments such as disruption of a major botnet, arrest of a ransomware actor, and dismantling of a dark web marketplace are noted, the zero-day exploitation in Output Messenger remains the most concerning due to its targeted nature and potential for persistent espionage. No patch or mitigation is currently available for CVE-2025-27920, and no widespread exploitation beyond the targeted attacks has been reported. Indicators such as the domain api.wordinfos.com may relate to command and control infrastructure or malware communication channels. Overall, this threat represents a sophisticated compromise of a communication platform with significant espionage implications and supply chain risks.

Detailed information about The Good, the Bad and the Ugly in Cybersecurity – Week 20. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'dark web'

Filter Threats

Threats Tagged 'dark web'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility