보안 뉴스 업데이트
Cyber Security News Update
Every day at 8:00 a.m. KST — selected hacking and cybersecurity news from Korea and around the world, summarized with links to the original articles.
2026-11-06 (Fri) Morning edition
Today's Top 10
-
AI Hacking Tool 'ARTEX' Breaches 7 South Korean Banks
Attackers believed to be Chinese-speaking combined the AI penetration testing tool ARTEX with multiple AI models including Claude Code, DeepSeek, and Grok to breach 7 South Korean financial institutions from late September to early October. The attack exposed personal information of approximately 66,000 individuals and data on about 2,000 corporations, including personal details and income/loan information. CrowdStrike assessed that the attackers were likely financially motivated Chinese-speaking actors.
Cyberpress · Read original (opens in new window) ↗
-
37 Financial Firms Hacked, 470,000 Personal Records Leaked
Over a one-month period starting late September, 40 breach incidents occurred across 37 financial firms including banks, securities firms, and insurers, leaking approximately 473,000 personal records. The leaked data included names, resident registration numbers, and account numbers of employees and customers, while small virtual asset exchanges and electronic financial firms lost about 1 billion won. Financial authorities announced a full security inspection of roughly 580 financial companies, including virtual asset operators.
-
Bithumb, Hanyang Securities Hit by Dawoo Office Zero-Day Attack
Bithumb and Hanyang Securities suffered partial leaks of customer and employee personal information after attackers exploited a zero-day access-control vulnerability in the groupware solution Dawoo Office. Bithumb was attacked on October 27, and Hanyang Securities on October 29 — one day before the patch notice — with both breaches occurring before an official patch was released. Dawoo Technology and KISA issued emergency security patches, and financial authorities urged affected companies to apply them immediately.
-
French Bank Arkéa Loses $133 Million in Hacking Incident
French bank Crédit Mutuel Arkéa disclosed that attackers compromised an external partner's systems to carry out unauthorized fund transfers through the bank's own accounts. Between the nights of November 1 and 2, attackers converted about $63 million in stablecoins into Ethereum, and tracing revealed the total amount drained from the exchange ultimately exceeded $133 million. The bank stated customer accounts were unaffected and said it has frozen part of the converted assets while working to recover the rest.
The Record · Read original (opens in new window) ↗
-
'NIKKE' PC Launcher Spreads Malware via Supply Chain Attack
The PC launcher for the mobile game 'Goddess of Victory: NIKKE,' developed by Shift Up and distributed by Tencent's Level Infinite, was compromised in a supply chain attack that spread remote-control malware. On September 27, attackers obtained write access to a Tencent Cloud CDN server and injected a malicious loader into the launcher's JavaScript files, leading to the theft of cryptocurrency wallet data and developer cloud credentials for AWS, Azure, and GitHub. The malware used a stealth technique that kept it active in the Chrome browser even after the game was closed.
BleepingComputer · Read original (opens in new window) ↗
-
Crypto Exchange Prabank Suspends Service After Repeated Hacks
South Korean virtual asset exchange Prabank suspended its service after a hacking incident leaked personal information of 7 members. The leaked data included 8 items: name, email, mobile phone number, OTP key value, wallet address, and login password. Prabank had already suffered two breaches last month that resulted in the theft of about 100 million won worth of cryptocurrency from its hot wallet, fueling growing criticism of its security management.
-
C3RB3R Ransomware Spreading, Targeting Synology NAS Devices
Synology warned of increasing C3RB3R ransomware attacks targeting NAS devices running outdated, unpatched versions of DSM. Attackers are exploiting a vulnerability that was already fixed in December 2024 but left unpatched on some devices, encrypting files with the .L0CK3D extension and demanding payment. Synology advised users to immediately block internet exposure of the management web interface and update DSM to the latest version.
BleepingComputer · Read original (opens in new window) ↗
-
Douzone Bizon Hack Spreads to Clients of Client Companies
A follow-up investigation into the Douzone Bizon hacking incident found that old data from client companies that had terminated their service remained on backup servers, and that the breach extended to personal information of third parties with no direct business relationship with Douzone. The case has been cited as exposing a blind spot in personal data management at enterprise software providers. Affected client companies are notifying users of potential secondary harm and conducting further investigations.
머니투데이방송 · Read original (opens in new window) ↗
-
Password Manager App 'mSecure' Hacked, Customer Data Leaked
mSeven Software, the operator of the password manager app mSecure, disclosed that it suffered a cyberattack in which an encrypted customer database was stolen. The company advised both current and former users to change their passwords, reset two-factor authentication, and delete passkeys. Details such as the scale of the breach and the attack vector have not yet been disclosed.
BleepingComputer · Read original (opens in new window) ↗
-
UK School Network Hit by AI-Assisted 3AM Ransomware Attack
A UK school network was attacked by an affiliate of the 3AM ransomware group, which accessed the network through unmanaged hosts and encrypted 37 of about 50 compromised devices. Security firm Bitdefender assessed that the attackers likely used AI-generated commands and an automated agent loop, based on a pattern of slightly varied commands repeated at 40-to-100-second intervals. The case has drawn attention as an example of AI agents being used in a ransomware attack.
BleepingComputer · Read original (opens in new window) ↗
Korea — Hacking News
-
AI Hacking Tool 'ARTEX' Breaches 7 South Korean Banks
Attackers believed to be Chinese-speaking combined the AI penetration testing tool ARTEX with multiple AI models including Claude Code, DeepSeek, and Grok to breach 7 South Korean financial institutions from late September to early October. The attack exposed personal information of approximately 66,000 individuals and data on about 2,000 corporations, including personal details and income/loan information. CrowdStrike assessed that the attackers were likely financially motivated Chinese-speaking actors.
Cyberpress · Read original (opens in new window) ↗
-
37 Financial Firms Hacked, 470,000 Personal Records Leaked
Over a one-month period starting late September, 40 breach incidents occurred across 37 financial firms including banks, securities firms, and insurers, leaking approximately 473,000 personal records. The leaked data included names, resident registration numbers, and account numbers of employees and customers, while small virtual asset exchanges and electronic financial firms lost about 1 billion won. Financial authorities announced a full security inspection of roughly 580 financial companies, including virtual asset operators.
-
Bithumb, Hanyang Securities Hit by Dawoo Office Zero-Day Attack
Bithumb and Hanyang Securities suffered partial leaks of customer and employee personal information after attackers exploited a zero-day access-control vulnerability in the groupware solution Dawoo Office. Bithumb was attacked on October 27, and Hanyang Securities on October 29 — one day before the patch notice — with both breaches occurring before an official patch was released. Dawoo Technology and KISA issued emergency security patches, and financial authorities urged affected companies to apply them immediately.
-
Crypto Exchange Prabank Suspends Service After Repeated Hacks
South Korean virtual asset exchange Prabank suspended its service after a hacking incident leaked personal information of 7 members. The leaked data included 8 items: name, email, mobile phone number, OTP key value, wallet address, and login password. Prabank had already suffered two breaches last month that resulted in the theft of about 100 million won worth of cryptocurrency from its hot wallet, fueling growing criticism of its security management.
-
Douzone Bizon Hack Spreads to Clients of Client Companies
A follow-up investigation into the Douzone Bizon hacking incident found that old data from client companies that had terminated their service remained on backup servers, and that the breach extended to personal information of third parties with no direct business relationship with Douzone. The case has been cited as exposing a blind spot in personal data management at enterprise software providers. Affected client companies are notifying users of potential secondary harm and conducting further investigations.
머니투데이방송 · Read original (opens in new window) ↗
Global — Hacking News
-
French Bank Arkéa Loses $133 Million in Hacking Incident
French bank Crédit Mutuel Arkéa disclosed that attackers compromised an external partner's systems to carry out unauthorized fund transfers through the bank's own accounts. Between the nights of November 1 and 2, attackers converted about $63 million in stablecoins into Ethereum, and tracing revealed the total amount drained from the exchange ultimately exceeded $133 million. The bank stated customer accounts were unaffected and said it has frozen part of the converted assets while working to recover the rest.
The Record · Read original (opens in new window) ↗
-
'NIKKE' PC Launcher Spreads Malware via Supply Chain Attack
The PC launcher for the mobile game 'Goddess of Victory: NIKKE,' developed by Shift Up and distributed by Tencent's Level Infinite, was compromised in a supply chain attack that spread remote-control malware. On September 27, attackers obtained write access to a Tencent Cloud CDN server and injected a malicious loader into the launcher's JavaScript files, leading to the theft of cryptocurrency wallet data and developer cloud credentials for AWS, Azure, and GitHub. The malware used a stealth technique that kept it active in the Chrome browser even after the game was closed.
BleepingComputer · Read original (opens in new window) ↗
-
C3RB3R Ransomware Spreading, Targeting Synology NAS Devices
Synology warned of increasing C3RB3R ransomware attacks targeting NAS devices running outdated, unpatched versions of DSM. Attackers are exploiting a vulnerability that was already fixed in December 2024 but left unpatched on some devices, encrypting files with the .L0CK3D extension and demanding payment. Synology advised users to immediately block internet exposure of the management web interface and update DSM to the latest version.
BleepingComputer · Read original (opens in new window) ↗
-
Password Manager App 'mSecure' Hacked, Customer Data Leaked
mSeven Software, the operator of the password manager app mSecure, disclosed that it suffered a cyberattack in which an encrypted customer database was stolen. The company advised both current and former users to change their passwords, reset two-factor authentication, and delete passkeys. Details such as the scale of the breach and the attack vector have not yet been disclosed.
BleepingComputer · Read original (opens in new window) ↗
-
UK School Network Hit by AI-Assisted 3AM Ransomware Attack
A UK school network was attacked by an affiliate of the 3AM ransomware group, which accessed the network through unmanaged hosts and encrypted 37 of about 50 compromised devices. Security firm Bitdefender assessed that the attackers likely used AI-generated commands and an automated agent loop, based on a pattern of slightly varied commands repeated at 40-to-100-second intervals. The case has drawn attention as an example of AI agents being used in a ransomware attack.
BleepingComputer · Read original (opens in new window) ↗
Updated every day at 8:00 a.m. KST with selected hacking and cybersecurity news from Korea and abroad. Summaries are AI-generated — please check the original articles. Copyright of each article belongs to its publisher.