보안 뉴스 업데이트
Cyber Security News Update
Every day at 8:00 a.m. KST — selected hacking and cybersecurity news from Korea and around the world, summarized with links to the original articles.
2026-11-04 (Wed) Morning edition
Today's Top 10
-
Binance $6.3B Hack Officially Attributed to North Korea
The FBI has officially identified North Korea's 'TraderTraitor' hacking group as responsible for the theft of approximately $6.3 billion in crypto assets from Binance, the world's largest crypto exchange, in just over 20 minutes. Binance said the attackers tricked an employee with a fake job interview into installing malware, then took control of wallet infrastructure to steal the assets. The stolen funds were largely converted into Ethereum and are being laundered.
BleepingComputer/서울신문 · Read original (opens in new window) ↗
-
Douzone Bizon Hack Fallout Spreads: KEPCO KPS Warns of Possible Data Leak
KEPCO KPS, a KEPCO-invested firm, announced that encrypted personal data including resident registration numbers and contact information may have been exfiltrated following a hack of partner company Douzone Bizon's APO backup server. The company said the exact scope of the leak is under investigation, with potentially exposed items including names, affiliations, contact details, resident registration numbers, and business registration numbers. The incident appears to be spreading to multiple companies using Douzone Bizon's solutions.
-
NIS Launches Emergency Security Checks at 2,100 Sites After Financial Sector Hacks
The National Intelligence Service (NIS) has launched emergency security inspections at over 2,100 public institutions, including central and local government agencies, treating recent financial sector hacking incidents as a serious warning sign. Checklists were distributed to each institution for self-assessment of external access security, security monitoring systems, and patch status, with direct NIS inspections to be completed by mid-November. The Ministry of Science and ICT will separately inspect about 170 major private-sector information and communications infrastructure facilities.
-
Hackers Steal Hundreds of Millions of Won in Real Cash via Online Lender, Payment Processor Hacks
Seoul-based online investment-linked finance company Zoomfund had about 300 million won stolen from more than 100 customers after hackers breached its systems and disguised fraudulent transfers as legitimate transactions requested to banks. A domestic electronic payment service provider also suffered a hack resulting in 200 million won in merchant payment funds being siphoned off, which financial authorities are investigating. Previously, financial sector hacks had been limited to personal data leaks or cryptocurrency theft, but this marks the first confirmed case of actual Korean won cash being stolen.
-
Harvard Alumni System Hack Exposes Data Linked to Over 850,000 Accounts
Harvard University disclosed that its Alumni Affairs and Development system was hacked last November, exposing data associated with more than 851,000 unique email addresses. The leaked information included profile data for donors, alumni, parents, and some faculty and students, though the university said resident registration numbers or passport information were not stored in the affected system.
BleepingComputer · Read original (opens in new window) ↗
-
Ivanti Issues Additional Patches for Two Zero-Days in Connect Secure Exploited in Attacks
Ivanti has released additional security updates for two zero-day vulnerabilities in its Connect Secure (ICS) remote access gateway that have been chained together in attacks since October 1. Attackers were found exploiting the vulnerability chain to target BitLocker recovery keys rather than deploying web shells, and CISA confirmed two additional related attack cases.
SecurityWeek · Read original (opens in new window) ↗
-
C3RB3R Ransomware Attacks Spread Targeting Synology NAS Devices
Synology urged customers to update immediately after reporting ransomware attacks exploiting a patched DiskStation Manager (DSM) vulnerability. Affected users reported infection by C3RB3R ransomware, which encrypted files with a '.L0CK3D' extension, with analysis showing the attackers exploited a critical CVSS 9.8 login vulnerability patched in September.
The Hacker News · Read original (opens in new window) ↗
-
UK School Network Hit by 3AM Ransomware Suspected to Involve AI Use
A UK school management organization suffered a 3AM ransomware attack that encrypted 37 of about 50 devices accessible through an unmanaged host. Security firm Bitdefender said command patterns repeated and slightly modified at 40-100 second intervals suggest the attacker may have used AI-generated commands and automated agent loops. The attacker created two new domain administrator accounts and established two-way trust relationships across three Active Directory domains to expand the attack before stealing financial data.
BleepingComputer · Read original (opens in new window) ↗
-
Presidential Office Holds Emergency Meeting Over Personal Data Leak Allegations
South Korea's presidential office held an emergency meeting chaired by the Chief of Staff to address allegations of a personal data leak, discussing how the leak occurred and measures to prevent recurrence. Officials said they would coordinate with relevant ministries to develop a swift response plan.
-
Stalled Digital Asset Law Leaves No Compensation Standard for Crypto Hacking Victims
With legislation on the Digital Asset Basic Act delayed, domestic crypto exchanges remain reliant solely on their own compensation measures when hacked, with no legal standard in place. Upbit operator Dunamu previously covered about 44.5 billion won in losses from a Solana-based crypto theft last November using its own assets, and Bithumb similarly compensated victims from company funds after a theft of about 35 billion won in 2018.
ZDNet Korea · Read original (opens in new window) ↗
Korea — Hacking News
-
Douzone Bizon Hack Fallout Spreads: KEPCO KPS Warns of Possible Data Leak
KEPCO KPS, a KEPCO-invested firm, announced that encrypted personal data including resident registration numbers and contact information may have been exfiltrated following a hack of partner company Douzone Bizon's APO backup server. The company said the exact scope of the leak is under investigation, with potentially exposed items including names, affiliations, contact details, resident registration numbers, and business registration numbers. The incident appears to be spreading to multiple companies using Douzone Bizon's solutions.
-
Hackers Steal Hundreds of Millions of Won in Real Cash via Online Lender, Payment Processor Hacks
Seoul-based online investment-linked finance company Zoomfund had about 300 million won stolen from more than 100 customers after hackers breached its systems and disguised fraudulent transfers as legitimate transactions requested to banks. A domestic electronic payment service provider also suffered a hack resulting in 200 million won in merchant payment funds being siphoned off, which financial authorities are investigating. Previously, financial sector hacks had been limited to personal data leaks or cryptocurrency theft, but this marks the first confirmed case of actual Korean won cash being stolen.
-
NIS Launches Emergency Security Checks at 2,100 Sites After Financial Sector Hacks
The National Intelligence Service (NIS) has launched emergency security inspections at over 2,100 public institutions, including central and local government agencies, treating recent financial sector hacking incidents as a serious warning sign. Checklists were distributed to each institution for self-assessment of external access security, security monitoring systems, and patch status, with direct NIS inspections to be completed by mid-November. The Ministry of Science and ICT will separately inspect about 170 major private-sector information and communications infrastructure facilities.
-
Presidential Office Holds Emergency Meeting Over Personal Data Leak Allegations
South Korea's presidential office held an emergency meeting chaired by the Chief of Staff to address allegations of a personal data leak, discussing how the leak occurred and measures to prevent recurrence. Officials said they would coordinate with relevant ministries to develop a swift response plan.
-
Stalled Digital Asset Law Leaves No Compensation Standard for Crypto Hacking Victims
With legislation on the Digital Asset Basic Act delayed, domestic crypto exchanges remain reliant solely on their own compensation measures when hacked, with no legal standard in place. Upbit operator Dunamu previously covered about 44.5 billion won in losses from a Solana-based crypto theft last November using its own assets, and Bithumb similarly compensated victims from company funds after a theft of about 35 billion won in 2018.
ZDNet Korea · Read original (opens in new window) ↗
Global — Hacking News
-
Binance $6.3B Hack Officially Attributed to North Korea
The FBI has officially identified North Korea's 'TraderTraitor' hacking group as responsible for the theft of approximately $6.3 billion in crypto assets from Binance, the world's largest crypto exchange, in just over 20 minutes. Binance said the attackers tricked an employee with a fake job interview into installing malware, then took control of wallet infrastructure to steal the assets. The stolen funds were largely converted into Ethereum and are being laundered.
BleepingComputer/서울신문 · Read original (opens in new window) ↗
-
Harvard Alumni System Hack Exposes Data Linked to Over 850,000 Accounts
Harvard University disclosed that its Alumni Affairs and Development system was hacked last November, exposing data associated with more than 851,000 unique email addresses. The leaked information included profile data for donors, alumni, parents, and some faculty and students, though the university said resident registration numbers or passport information were not stored in the affected system.
BleepingComputer · Read original (opens in new window) ↗
-
Ivanti Issues Additional Patches for Two Zero-Days in Connect Secure Exploited in Attacks
Ivanti has released additional security updates for two zero-day vulnerabilities in its Connect Secure (ICS) remote access gateway that have been chained together in attacks since October 1. Attackers were found exploiting the vulnerability chain to target BitLocker recovery keys rather than deploying web shells, and CISA confirmed two additional related attack cases.
SecurityWeek · Read original (opens in new window) ↗
-
C3RB3R Ransomware Attacks Spread Targeting Synology NAS Devices
Synology urged customers to update immediately after reporting ransomware attacks exploiting a patched DiskStation Manager (DSM) vulnerability. Affected users reported infection by C3RB3R ransomware, which encrypted files with a '.L0CK3D' extension, with analysis showing the attackers exploited a critical CVSS 9.8 login vulnerability patched in September.
The Hacker News · Read original (opens in new window) ↗
-
UK School Network Hit by 3AM Ransomware Suspected to Involve AI Use
A UK school management organization suffered a 3AM ransomware attack that encrypted 37 of about 50 devices accessible through an unmanaged host. Security firm Bitdefender said command patterns repeated and slightly modified at 40-100 second intervals suggest the attacker may have used AI-generated commands and automated agent loops. The attacker created two new domain administrator accounts and established two-way trust relationships across three Active Directory domains to expand the attack before stealing financial data.
BleepingComputer · Read original (opens in new window) ↗
Updated every day at 8:00 a.m. KST with selected hacking and cybersecurity news from Korea and abroad. Summaries are AI-generated — please check the original articles. Copyright of each article belongs to its publisher.