Qilin RaaS Breach Exposes 1 Million Files, 2TB of Data in Korean MSP Attack

The “Korean Leaks” campaign highlights a sophisticated supply-chain attack targeting South Korea’s financial sector.

This operation combined the capabilities of a major Ransomware-as-a-Service (RaaS) group, Qilin, with potential involvement from North Korean state-affiliated actors (Moonstone Sleet), leveraging Managed Service Provider (MSP) compromise as the initial access vector.

South Korea’s financial sector has become the target of a coordinated ransomware campaign that exposed over 1 million files and approximately 2 terabytes of sensitive data.

Dubbed “Korean Leaks,” was orchestrated by Qilin, a prominent Ransomware-as-a-Service group, in collaboration with suspected North Korean state-affiliated threat actors.

Bitdefender’s threat intelligence team identified the campaign after noticing an unusual statistical anomaly: South Korea suddenly emerged as the second most-targeted country for ransomware attacks in September 2025, with 25 victims claimed in a single month.

A dramatic departure from established ransomware trends that typically concentrate on the United States, Canada, and Western Europe.

The investigation revealed that all victims were concentrated in South Korea’s financial services sector, specifically asset management companies, with the exception of one construction firm.

This extreme concentration signaled a highly targeted, purposeful campaign rather than opportunistic attacks, prompting deeper analysis of the operation’s structure and origins.

The Qilin Connection

Qilin, a Russian-origin RaaS platform, led the group’s involvement in the campaign. The group operates under the guise of “political activists,” regularly posting manifestos alongside stolen data on their Dedicated Leak Site (DLS).

However, their near 1,000 claimed ransom victims to date suggest that financial motivation, rather than ideological conviction, drives their operations.

This approach exemplifies the emerging trend of hacktivism merged with ransomware’s profitability for maximum extortion leverage.

The campaign introduced a critical discovery: Moonstone Sleet, a North Korean state-affiliated hacking group, joined Qilin as an affiliate in early 2025.

This partnership blurs traditional threat actor categorizations, merging state-sponsored espionage with cybercriminal operations while providing plausible deniability for attribution a trend security researchers predicted would accelerate throughout 2025.

The “Korean Leaks” campaign unfolded across three publication waves between September and early October 2025. Wave 1 (September 14) documented 10 financial management firms, followed by Wave 2 (September 17-19) with nine additional victims.

Wave 3 (September 28-October 4) added nine more companies to the public leak site.

The messaging evolved strategically across waves: initially framing the attacks as exposing systemic corruption and stock market manipulation, then escalating to threats against South Korea’s entire financial market, before finally reverting to individual victim extortion.

The attackers shared approximately 300 proof-of-compromise photos documenting exfiltrated materials.

However, the majority of victim posts lacked detailed data metrics regarding file counts or data volumes, suggesting the actual scope may exceed the documented 1 million files and 2 TB figure.

Supply Chain Attack Vector

Investigators determined that the most probable attack vector involved compromising an upstream Managed Service Provider rather than exploiting zero-day vulnerabilities or acquiring insider credentials.

A domestic South Korean IT service provider that manages systems for asset managers served as the single point of failure, granting simultaneous access to multiple similarly-configured client networks.

This MSP compromise hypothesis was subsequently confirmed by press reporting, with the Korea JoongAng Daily documenting that more than 20 asset management firms shared a common link through a single IT service provider’s breach.

The operation underscores a critical cybersecurity blind spot: while software supply chain attacks dominate industry discussions, third-party service provider compromises remain a more prevalent yet often-overlooked threat vector for large-scale, coordinated ransomware campaigns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.