Observed ransomware activity — South Korea (country)

These are provider-observed claim records, not incident confirmations, attacker origin, confirmed targeting intent, or a prediction of future risk.

These profiles count claim records, keyed by victim identity, compare sector labels without case or extra spaces, and leave out catch-all labels such as “Other” or “N/A”; Kosovo counts as a country here. The home page, the map and the monthly reports count distinct claims (repeat postings within 7 days merged) under exact sector labels, so their numbers differ.

• Newly observed claim records, last 12 complete months: 96
• Claim records, last 24 complete months: 96
• Distinct observed groups (24 months): 33
• Active months (24 months): 10
• Independent providers (24 months): 5
• By timestamp basis (12 months): 91 newly observed by providers, 5 provider-reported claim dates

Top observed groups

• n0n — 15 distinct victim identities
• Barracuda — 8 distinct victim identities
• beast — 8 distinct victim identities
• qilin — 8 distinct victim identities
• Ulose — 6 distinct victim identities

Methodology & data freshness

Observation interval: Complete calendar months over the trailing 24 months, ending at the start of the current UTC month.. Dataset anchor 2026-11-01T00:00:00.000Z; 14,155 canonical records represented. Only discovery-basis rows are counted as newly observed by providers.

How to cite: Dragons Eye Ransomware Tracker, “Observed ransomware activity — South Korea (country)”, provider-observed ransomware claim data as of 2026-11-01, this page's URL. Keep the observed-claim caveat with any reused figures; the methodology documents the evidence model and the data-quality dashboard quantifies screening and exclusions.

Ordered by measured change and, where available, AI-prioritized; every fact is calculated deterministically from provider observations. Records are provider-reported claims, not confirmed incidents. Source: reconciled leak-site victim claims across independent providers.

Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.

All activity profiles · Weekly signals · Victim-claim directory · Intelligence overview

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.

Data as of 2026-11-02 03:24 UTC (the observed time of the newest claim record in this page's prerender data snapshot; snapshot built 2026-11-02 03:51 UTC; dataset version sig-c8140e6930616b9f0c8a1e58f11be44ebebfb4fe8a82be4757d96f7e38bf4737).