Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This comprehensive analysis covers cyber threats targeting financial companies in Korea and globally. It examines malware and phishing cases, top 10 malware strains, and statistics on leaked Korean accounts. The report delves into major financial threats on the dark web, including credit card data breaches, database breaches, and ransomware attacks. A notable case involves the Arkana ransomware group's breach of a global online brokerage firm, In***, resulting in the theft of 50 GB of customer data, including KYC submissions and information of over 163,000 customers. The incident highlights vulnerabilities in trading platforms' identity verification and account protection systems, emphasizing the need for enhanced security measures beyond regulatory compliance.

The May 2025 Security Issues campaign highlights a series of cyber threats targeting financial institutions primarily in South Korea but with global implications. The campaign details multiple attack vectors including malware infections, phishing campaigns, and ransomware attacks, with a focus on the financial sector. Key malware strains are identified among the top 10 most prevalent, contributing to data breaches and account compromises. A significant incident involved the Arkana ransomware group breaching a global online brokerage firm, resulting in the theft of approximately 50 GB of sensitive customer data. This data included Know Your Customer (KYC) submissions and personal information of over 163,000 customers, exposing critical vulnerabilities in identity verification and account protection mechanisms within trading platforms. The campaign also discusses the presence of stolen financial data on the dark web, including credit card and database breaches, which facilitate identity theft and fraud. The threat actors employ a range of tactics, techniques, and procedures (TTPs) such as ransomware deployment (T1486), data destruction (T1489), credential access (T1078), phishing (T1566), and command and control communications (T1071). The campaign underscores that existing regulatory compliance measures are insufficient to mitigate these risks, emphasizing the need for enhanced security controls tailored to the unique challenges of financial services platforms. Indicators of compromise include multiple malware hashes linked to the Arkana group and associated ransomware families like LockBit. Although no known exploits in the wild are reported, the campaign reflects ongoing and evolving threats to financial institutions' confidentiality, integrity, and availability of data and services.

Detailed information about May 2025 Security Issues in Korean & Global Financial Sector. Get real-time updates, technical details, and mitigation strategies.

May 2025 Security Issues in Korean & Global Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

May 2025 Security Issues in Korean & Global Financial Sector

A breach of LockBit's dark web affiliate panels exposed a rare glimpse into their operations. The leaked data included Bitcoin addresses, admin credentials, and a chat log revealing negotiation tactics and ransom demands. Ransom amounts varied widely, with some victims confused about the demands. The breach exposed LockBit's research into victims' finances and their willingness to provide additional services for a fee. The incident highlights the complexities of cybercrime negotiations and the human stories behind the headlines. Additionally, Cisco Talos observed a trend of attack kill chains being split into two stages, executed by separate threat actors, leading to refined definitions of initial access brokers.

The recent breach of LockBit's dark web affiliate panels provides an unprecedented insight into the operational mechanics of one of the most prolific ransomware groups. LockBit operates through an affiliate model, where independent threat actors gain access to ransomware tools and infrastructure to conduct attacks, sharing profits with the core group. The leaked data includes Bitcoin addresses used for ransom payments, administrative credentials for the affiliate panels, and chat logs that reveal negotiation tactics and ransom demand strategies. Notably, ransom demands vary significantly, sometimes causing confusion among victims, which indicates a flexible but complex negotiation process tailored to each victim's perceived ability to pay. The breach also exposed LockBit's internal research into victims' financial situations, suggesting a targeted approach to maximize ransom yields. Furthermore, LockBit offers additional paid services, such as data leak site management and victim support, indicating a sophisticated criminal business model. Cisco Talos' observations of attack kill chains being split into two stages, executed by separate threat actors, highlight an evolution in ransomware operations. This division of labor refines the role of initial access brokers, who specialize in gaining entry to networks and then selling or handing off access to ransomware affiliates. The technical indicators provided, including multiple file hashes, can assist defenders in identifying related malware or tools used by LockBit affiliates. Overall, this breach sheds light on the human and operational complexities behind ransomware campaigns, emphasizing the importance of understanding adversary tactics beyond technical exploits.

Detailed information about Unfiltered look into LockBit’s operations. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'data breach'

Filter Threats

Threats Tagged 'data breach'