Qilin ransomware launches massive supply chain attack on South Korea’s financial sector

A Rising Threat: Qilin’s Rapid Expansion

Qilin ransomware just hit South Korea’s financial sector with a major supply chain attack.

BitDefender says this operation shows just how powerful Qilin is as a ransomware-as-a-service group. There’s a good chance North Korean government hackers, specifically Moonstone Sleet, are involved too. They went after managed service providers early on to get their foot in the door.

Qilin has been growing fast, and ransomware attacks have spiked this year because of it. By October 2025, they’d already gone after more than 180 people. NCC Group’s data pins about 29% of all ransomware attacks on Qilin alone.

A Spike in South Korean Victims

A Romanian cybersecurity company noticed a sudden surge in ransomware victims in South Korea back in September 2025. There were 25 cases that month, making South Korea second only to the U.S. This was a huge jump from the usual two cases per month over the previous year.

Digging deeper, 24 out of those 25 victims were in finance, and every one of them got hit by Qilin. The attackers even named their campaign “Korean Leaks.”

Inside Qilin: A Russian Ransomware Operation

Qilin, based in Russia, likes to call its members “political activists” and “patriots.” They run things with an affiliate model; hackers sign up and get a cut, usually around 20% of whatever ransom money they pull in.

One of those affiliates is Moonstone Sleet, a North Korean government group. Microsoft says they used a custom ransomware called FakePenny to attack a defense tech company back in April 2024.

Everything shifted in February. That’s when Qilin ransomware started causing real damage to several organizations. No one’s totally sure if the main group was behind every attack, but going after South Korean businesses definitely fits their pattern.

The Korean Leaks: Scale of the Data Theft

Over 1 million files and nearly 2 TB of data were stolen from 28 victims in three separate waves of Korean leaks. BitDefender reported that data from four additional victims was removed from the leak site (DLS), either after ransom negotiations or due to internal policy.

The three waves were as follows:

The first wave: This included 10 victims in the financial management sector and was published on September 14, 2025.

The second wave: This included 9 victims and was published between September 17 and 19, 2025.

The third wave: This also included 9 victims and was published between September 28 and October 4, 2025.

The strangest thing about these leaks is that instead of applying direct pressure as before, they are now using more propaganda and political language.

BitDefender said of the first wave of the campaign: “The entire campaign was presented as a public service effort. For example, they threatened to leak files that could provide evidence of ‘stock market fraud’ or expose the names of ‘prominent Korean politicians and businessmen’ if their demands were not met.”

Found this article interesting? Explore more ransomware security insights and threat updates.

Frequently Asked Questions (FAQs)