보안 뉴스 업데이트
Cyber Security News Update
Every day at 8:00 a.m. KST — selected hacking and cybersecurity news from Korea and around the world, summarized with links to the original articles.
2026-11-03 (Tue) Morning edition
Today's Top 10
-
Binance $6.3 Billion Hack Confirmed as North Korean Operation
Binance suffered a hack on the 29th of last month in which approximately $6.3 billion worth of crypto assets were drained. The FBI officially confirmed that North Korea's Lazarus Group (TraderTraitor) was behind the attack. Binance covered 90% of the losses with its own funds, stating that full recovery will take more time.
-
Douzone Bizon Hack Escalated to Major Incident
Servers and backup systems at Douzone Bizon, which provides the 'Smart A10' IT solution for small and medium businesses, were breached. The exposed data reportedly includes resident registration numbers, payroll accounts, and partner companies' financial records for employees and their families, prompting the Ministry of Science and ICT to form a joint public-private investigation team. The number of potentially affected companies is feared to reach into the millions.
-
HYBE Data Leak via Integrated E-Approval Document Solution
HYBE discovered abnormal access through a third-party document preview solution linked to its electronic approval system during an internal review. The leaked data includes resident registration numbers, passport numbers, and account numbers of current and former employees and partner personnel. The company has blocked the attack vector and reported the incident to KISA and the Personal Information Protection Commission.
ZDNet Korea · Read original (opens in new window) ↗
-
Over 1,000 GitLab Servers Exposed to Critical Flaw
A critical integer overflow flaw (CVE-2026-97229) in the regex compiler used for processing CI/CD pipeline configurations is being actively exploited. GitLab released a fix on the 12th of last month, but a Shadowserver investigation found that over 1,000 servers remain unpatched and exposed online. The US CISA has ordered emergency remediation for federal agencies.
BleepingComputer · Read original (opens in new window) ↗
-
Fake 'Claude Code' Extension Spreads via Cursor Marketplace
An extension impersonating Anthropic's Claude Code was uploaded to the AI coding editor Cursor's extension marketplace and was installed by up to 5,000 users. The malware inserted an attacker-controlled key into the SSH authorized-access list and exfiltrated PC information such as IP addresses and computer names. However, actual intrusion was found to have been blocked on the majority of PCs that lacked administrator privileges.
-
Online Lending Platform ZoomFund Hacked, 300 Million Won in Customer Deposits Leaked
Online investment-linked finance company ZoomFund had its IT systems hacked, resulting in roughly 300 million won of customer deposits being transferred to third-party accounts. This marks the first case of actual customer funds being stolen through a system breach in the sector, reigniting concerns about weak security capabilities at small online lending firms. Regulators are pursuing legislative amendments to improve asset management systems for firms that suspend operations.
-
Synology NAS Devices Targeted in Wave of C3RB3R Ransomware Attacks
Synology warned of C3RB3R ransomware attacks targeting NAS devices running outdated DSM versions, exploiting a vulnerability patched in December 2024. The ransomware encrypts files, appends the '.L0CK3D' extension, and demands payment for a decryption tool. More than 380,000 Synology devices exposed to the internet have reportedly been tracked.
BleepingComputer · Read original (opens in new window) ↗
-
New Ransomware Group 'Non' Tops Attacks on Korean Companies
The ransomware group 'Non,' which emerged in September, attacked 13 Korean companies this year, making it the most active group domestically. The group spends over 9.62 million won per month running 154 models on open-source AI coding tools to automate attack tool development and debugging. Multiple domestic industries, including shipping, ports, and IT, were targeted simultaneously.
-
Applebee's App Source Code Exposes Database Password
A security researcher discovered that the Applebee's restaurant chain's Android app source code contained a plaintext database access password. The key alone could allow access to the database by impersonating a legitimate user, risking exposure of member information including dates of birth, phone numbers, and recent login IPs. With no reporting channel available at the company, the researcher disclosed the flaw through the media, after which it was fixed.
-
Financial Sector Hack Spreads for a Month, Secondary Damage Feared
The hacking incident that began at Shinhan Bank has continued for over a month, with nearly 100,000 cases of personal data leaked across 16 financial companies. Concerns are rising that unchangeable information such as names and contact details, when combined with other leaked data, could enable targeted financial fraud. The Financial Services Commission plans to hold an industry-wide response meeting on the 5th to discuss extending the special response period and strengthening monitoring of abnormal transactions.
Korea — Hacking News
-
Douzone Bizon Hack Escalated to Major Incident
Servers and backup systems at Douzone Bizon, which provides the 'Smart A10' IT solution for small and medium businesses, were breached. The exposed data reportedly includes resident registration numbers, payroll accounts, and partner companies' financial records for employees and their families, prompting the Ministry of Science and ICT to form a joint public-private investigation team. The number of potentially affected companies is feared to reach into the millions.
-
HYBE Data Leak via Integrated E-Approval Document Solution
HYBE discovered abnormal access through a third-party document preview solution linked to its electronic approval system during an internal review. The leaked data includes resident registration numbers, passport numbers, and account numbers of current and former employees and partner personnel. The company has blocked the attack vector and reported the incident to KISA and the Personal Information Protection Commission.
ZDNet Korea · Read original (opens in new window) ↗
-
Online Lending Platform ZoomFund Hacked, 300 Million Won in Customer Deposits Leaked
Online investment-linked finance company ZoomFund had its IT systems hacked, resulting in roughly 300 million won of customer deposits being transferred to third-party accounts. This marks the first case of actual customer funds being stolen through a system breach in the sector, reigniting concerns about weak security capabilities at small online lending firms. Regulators are pursuing legislative amendments to improve asset management systems for firms that suspend operations.
-
New Ransomware Group 'Non' Tops Attacks on Korean Companies
The ransomware group 'Non,' which emerged in September, attacked 13 Korean companies this year, making it the most active group domestically. The group spends over 9.62 million won per month running 154 models on open-source AI coding tools to automate attack tool development and debugging. Multiple domestic industries, including shipping, ports, and IT, were targeted simultaneously.
-
Financial Sector Hack Spreads for a Month, Secondary Damage Feared
The hacking incident that began at Shinhan Bank has continued for over a month, with nearly 100,000 cases of personal data leaked across 16 financial companies. Concerns are rising that unchangeable information such as names and contact details, when combined with other leaked data, could enable targeted financial fraud. The Financial Services Commission plans to hold an industry-wide response meeting on the 5th to discuss extending the special response period and strengthening monitoring of abnormal transactions.
Global — Hacking News
-
Binance $6.3 Billion Hack Confirmed as North Korean Operation
Binance suffered a hack on the 29th of last month in which approximately $6.3 billion worth of crypto assets were drained. The FBI officially confirmed that North Korea's Lazarus Group (TraderTraitor) was behind the attack. Binance covered 90% of the losses with its own funds, stating that full recovery will take more time.
-
Over 1,000 GitLab Servers Exposed to Critical Flaw
A critical integer overflow flaw (CVE-2026-97229) in the regex compiler used for processing CI/CD pipeline configurations is being actively exploited. GitLab released a fix on the 12th of last month, but a Shadowserver investigation found that over 1,000 servers remain unpatched and exposed online. The US CISA has ordered emergency remediation for federal agencies.
BleepingComputer · Read original (opens in new window) ↗
-
Fake 'Claude Code' Extension Spreads via Cursor Marketplace
An extension impersonating Anthropic's Claude Code was uploaded to the AI coding editor Cursor's extension marketplace and was installed by up to 5,000 users. The malware inserted an attacker-controlled key into the SSH authorized-access list and exfiltrated PC information such as IP addresses and computer names. However, actual intrusion was found to have been blocked on the majority of PCs that lacked administrator privileges.
-
Synology NAS Devices Targeted in Wave of C3RB3R Ransomware Attacks
Synology warned of C3RB3R ransomware attacks targeting NAS devices running outdated DSM versions, exploiting a vulnerability patched in December 2024. The ransomware encrypts files, appends the '.L0CK3D' extension, and demands payment for a decryption tool. More than 380,000 Synology devices exposed to the internet have reportedly been tracked.
BleepingComputer · Read original (opens in new window) ↗
-
Applebee's App Source Code Exposes Database Password
A security researcher discovered that the Applebee's restaurant chain's Android app source code contained a plaintext database access password. The key alone could allow access to the database by impersonating a legitimate user, risking exposure of member information including dates of birth, phone numbers, and recent login IPs. With no reporting channel available at the company, the researcher disclosed the flaw through the media, after which it was fixed.
Updated every day at 8:00 a.m. KST with selected hacking and cybersecurity news from Korea and abroad. Summaries are AI-generated — please check the original articles. Copyright of each article belongs to its publisher.