VULNpocalypse
LowBreach / campaignMonitoring

Obsoft ransomware group claims attack on a South Korean company

RansomLook reports the obsoft ransomware group lists a South Korean company on its leak site; the victim has not confirmed it.

Published
Exploitation
No evidence in the sources; the only source is a leak-site listing tracked by RansomLook, which is a claim and not proof

What happened

According to RansomLook, a ransomware and extortion tracker, the obsoft group lists “Company #1” with the masked domain www.b**b*t.**.kr on its leak site. RansomLook shows the entry dated 2026-11-10. The listing is a claim made by the group. It is not proof that an attack or data theft took place.

RansomLook’s entry for this listing says the following, in the tracker’s own wording:

  • Status: “Resolved”.
  • Size: 508.6GB.
  • Country: South Korea.
  • Updated: Oct 12, 2026 2:28 PM UTC.
  • Marker: “Data Destroyed”.

The source does not explain what “Resolved” or “Data Destroyed” mean. It does not say whether a ransom was paid, whether data was published, or whether the group removed anything.

RansomLook also lists five other South Korean entries from the same group on the same date. They are not covered in this advisory.

What is not confirmed:

  • The victim has not confirmed the claim in any source provided.
  • No independent outlet or official body has verified it.
  • The entry point, the kind of data involved and the real data volume are not confirmed.
  • The full name of the company is not confirmed. The domain is masked in the listing.

Am I affected?

Not confirmed. The only source is a tracker’s copy of the group’s leak-site listing, and the domain is partly masked, so it cannot be matched to a specific organisation from this data.

You are only potentially relevant if you operate a South Korean website matching the masked pattern www.b**b*t.**.kr, or if you are a customer or partner of such an organisation. Even then, the sources do not show that your data is involved.

What to do now

  1. If you run the matching site, review your own logs and backups for signs of unauthorised access and tell your incident response contact. The sources do not describe how access was gained, so no specific indicators are available.
  2. If you are a customer or partner of a company you think matches, ask it directly for an official statement. Do not rely on the leak-site listing alone.
  3. Do not visit the group’s leak site or contact the group. Use official channels from the organisation or its national CERT.
  4. Watch for an official statement from the victim. This advisory will be updated only if a source confirms or refutes the claim.

Sources