Inva Malaj : 19 September 2025 10:43
Imagine waking up one morning and discovering that your sensitive financial data—contracts, customer lists, investment strategies—is exposed on a hidden site on the dark web, with a timer threatening to make it public unless you pay a ransom. This is exactly what happened to ten asset management firms in South Korea, victims of the “Korean Leak” campaign orchestrated by the Qilin ransomware group.
Through CTI and OSINT monitoring—with sources such as Ransomware.live and H4ckmanac—it emerged that the Qilin group targeted the South Korean asset management sector. Direct verification on their onion site confirmed the publication, on September 14, of victim profiles identified as Korean Leak, accompanied by exfiltrated data samples. Below are the ten affected organizations, based on verified claims and IOCs extracted from the Data Leak Site (DLS):
These claims show a progressive publication pattern: initial previews followed by full dumps if the ransom is not paid.
Qilin isn’t just a name: it derives from a Chinese mythological creature symbolizing epochal change, and the group uses it to assert a mission that goes beyond criminal profit. As emerges from Red Hot Cyber exclusive interview, Qilin presents itself as a supporter of a “multipolar world,” with anti-Western tones and a decentralized structure involving teams in multiple countries. But behind the rhetoric lies a sophisticated RaaS (Ransomware-as-a-Service) operation, with payloads developed in-house in Rust and C to evade defenses.
The group has been active since 2022 and has climbed the threat rankings: in April 2025 alone, it claimed 72 victims, including the South Korean wave. Their infrastructure includes a Data Leak Site (DLS) on Tor, known as “WikiLeaks V2,” accessible via onion addresses as ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion, where they publish data for extortion purposes.
From the Red Hot Cyber interview, Qilin reveals they use “everything”: phishing, internally researched 0-day/1-day exploits, and prolonged exposure to networks to study processes before encryption. Their stack includes:
Specific extracted IOCs include C2 IPs such as 176.113.115.97 and numerous MD5 payload hashes, confirming the use of FTP for the stolen data transfer.
Qilin operates as a RaaS with an 80/20 split (affiliates/service), and part of the revenue is declared to be allocated to “freedom movements.” The “double extortion” has evolved: in addition to encryption, they threaten auctions, sale to competitors, or full disclosure. They even offer preemptive “immunity” for a fee, likened to a “vaccine.”
In 2025, they added the “intimidation package”: in-house legal and journalist teams for negotiations and media campaigns, with 1 PB of storage and integrated DDoS tools. Qilin isn’t just code: it’s a hybrid threat that mixes crime, ideology, and innovation. Understanding it is the first step to countering it.
Inva Malaj