보안 뉴스 업데이트
Cyber Security News Update
Every day at 8:00 a.m. KST — selected hacking and cybersecurity news from Korea and around the world, summarized with links to the original articles.
2026-10-31 (Sat) Morning edition
Today's Top 10
-
Binance Suffers ~$8 Trillion Won Crypto Theft, North Korea's Lazarus Group Blamed
Blockchain analytics firm TRM has attributed a roughly $6.3 billion cryptocurrency theft from Binance to a unit of North Korea's Lazarus Group. The attackers reportedly compromised a DevOps engineer's laptop to gain access to internal systems before executing unauthorized withdrawal transactions.
-
Hanwha Systems Confirms Possible Leak of Employee Personal Data
Hanwha Systems confirmed unauthorized access to its internal network through remote access accounts at some affiliates and reported the incident to the Korea Internet & Security Agency and the Personal Information Protection Commission. The company stated the breach is unrelated to its defense or finance divisions.
-
GS Construction's Xi Apartment Residents' Personal Data Leaked
GS Construction confirmed that personal information of apartment residents was leaked through unauthorized external access to its community facility reservation management system. The exposed data includes names, addresses, and contact information, as well as residence type.
-
Chinese Hackers Use AI Framework to Hit 200+ Organizations Simultaneously
CrowdStrike reported that China-linked threat group Vapor Panda used an AI-powered intrusion framework called ARTEX to simultaneously attack more than 200 organizations worldwide starting October 17. Targets included foreign ministries and organizations in the semiconductor, defense, and telecommunications sectors, with some attacks progressing from initial intrusion to privilege escalation in under three hours.
The Hacker News · Read original (opens in new window) ↗
-
Chinese Hackers Exploit PHP2Shell to Breach Firewalls Linked to U.S. Government
China-linked hackers targeted Palo Alto firewalls using the PHP2Shell attack chain, which combines a PHP vulnerability with a Linux privilege escalation flaw. They attacked 25 internet-exposed firewalls, installing web shells on multiple devices, including servers linked to the U.S. government.
TechRadar · Read original (opens in new window) ↗
-
Money Today Hack Spills Over, Exposing Donghaeng Media Subscriber Data
Donghaeng Media Sidae disclosed that data from 526 past weekly magazine subscribers, held by its personal data processing vendor Money Today, was leaked in a hacking incident. The exposed information includes user IDs, names, phone numbers, and email addresses.
-
Lotte Affiliate GifTL Hacked, Data of Over 18,000 Users Leaked
The operator of GifTL, a Lotte Group-affiliated mobile coupon service, suffered unauthorized external access that leaked the names, phone numbers, emails, and refund account information of 18,359 customers. The resulting service suspension disrupted use at 24 brands including Lotteria, prompting compensation measures.
-
Japanese Email Service Provider Arara Hacked, 3.01 Million Records Exposed
Japanese email delivery service provider Arara was attacked through a web server vulnerability, resulting in the exfiltration of approximately 3.01 million customer email addresses. The company said it detected the unauthorized access and immediately disconnected the affected server from its network.
-
Crypto-Mining Attacks Exploiting Hugging Face Resurface
Pluto Security discovered cryptocurrency mining malware taking over GPU servers across 7 accounts and 31 repositories on Hugging Face's model hub. The attackers abused a feature allowing models to execute their own code, removing competing mining programs and planting malware that restarts itself when forcibly terminated.
BleepingComputer · Read original (opens in new window) ↗
-
Genians Warns 96% of Internal PHP Devices Exposed to Vulnerability
Security firm Genians reported that an analysis of client data found 96% of PHP-based devices on internal networks remain exposed to the PHP2Shell vulnerability. The firm warned that NAS devices and routers invisible to external scanners could serve as footholds for ransomware spread, urging immediate inspection and patching.
Korea — Hacking News
-
Hanwha Systems Confirms Possible Leak of Employee Personal Data
Hanwha Systems confirmed unauthorized access to its internal network through remote access accounts at some affiliates and reported the incident to the Korea Internet & Security Agency and the Personal Information Protection Commission. The company stated the breach is unrelated to its defense or finance divisions.
-
GS Construction's Xi Apartment Residents' Personal Data Leaked
GS Construction confirmed that personal information of apartment residents was leaked through unauthorized external access to its community facility reservation management system. The exposed data includes names, addresses, and contact information, as well as residence type.
-
Money Today Hack Spills Over, Exposing Donghaeng Media Subscriber Data
Donghaeng Media Sidae disclosed that data from 526 past weekly magazine subscribers, held by its personal data processing vendor Money Today, was leaked in a hacking incident. The exposed information includes user IDs, names, phone numbers, and email addresses.
-
Lotte Affiliate GifTL Hacked, Data of Over 18,000 Users Leaked
The operator of GifTL, a Lotte Group-affiliated mobile coupon service, suffered unauthorized external access that leaked the names, phone numbers, emails, and refund account information of 18,359 customers. The resulting service suspension disrupted use at 24 brands including Lotteria, prompting compensation measures.
-
Genians Warns 96% of Internal PHP Devices Exposed to Vulnerability
Security firm Genians reported that an analysis of client data found 96% of PHP-based devices on internal networks remain exposed to the PHP2Shell vulnerability. The firm warned that NAS devices and routers invisible to external scanners could serve as footholds for ransomware spread, urging immediate inspection and patching.
Global — Hacking News
-
Binance Suffers ~$8 Trillion Won Crypto Theft, North Korea's Lazarus Group Blamed
Blockchain analytics firm TRM has attributed a roughly $6.3 billion cryptocurrency theft from Binance to a unit of North Korea's Lazarus Group. The attackers reportedly compromised a DevOps engineer's laptop to gain access to internal systems before executing unauthorized withdrawal transactions.
-
Chinese Hackers Use AI Framework to Hit 200+ Organizations Simultaneously
CrowdStrike reported that China-linked threat group Vapor Panda used an AI-powered intrusion framework called ARTEX to simultaneously attack more than 200 organizations worldwide starting October 17. Targets included foreign ministries and organizations in the semiconductor, defense, and telecommunications sectors, with some attacks progressing from initial intrusion to privilege escalation in under three hours.
The Hacker News · Read original (opens in new window) ↗
-
Chinese Hackers Exploit PHP2Shell to Breach Firewalls Linked to U.S. Government
China-linked hackers targeted Palo Alto firewalls using the PHP2Shell attack chain, which combines a PHP vulnerability with a Linux privilege escalation flaw. They attacked 25 internet-exposed firewalls, installing web shells on multiple devices, including servers linked to the U.S. government.
TechRadar · Read original (opens in new window) ↗
-
Japanese Email Service Provider Arara Hacked, 3.01 Million Records Exposed
Japanese email delivery service provider Arara was attacked through a web server vulnerability, resulting in the exfiltration of approximately 3.01 million customer email addresses. The company said it detected the unauthorized access and immediately disconnected the affected server from its network.
-
Crypto-Mining Attacks Exploiting Hugging Face Resurface
Pluto Security discovered cryptocurrency mining malware taking over GPU servers across 7 accounts and 31 repositories on Hugging Face's model hub. The attackers abused a feature allowing models to execute their own code, removing competing mining programs and planting malware that restarts itself when forcibly terminated.
BleepingComputer · Read original (opens in new window) ↗
Updated every day at 8:00 a.m. KST with selected hacking and cybersecurity news from Korea and abroad. Summaries are AI-generated — please check the original articles. Copyright of each article belongs to its publisher.