VULNpocalypse
LowBreach / campaignMonitoring

Obsoft ransomware group claims attack on South Korean Company #2

RansomLook says the obsoft group lists South Korean Company #2 on its leak site; unconfirmed, so check your own exposure.

Published
Exploitation
No confirmation. The only evidence is a leak-site listing tracked by RansomLook, which is a claim, not proof.

What happened

According to the ransomware tracker RansomLook, the obsoft ransomware group has listed an entry titled “Company #2 www.gun.*.kr” on its leak site. RansomLook reports the entry as dated 2026-11-10. The domain is masked in the listing, so the organisation’s full name is not confirmed.

RansomLook’s entry for the post says the following. These are details of the listing as RansomLook presents it, not verified facts:

  • Country: South Korea.
  • Size: 45.2TB.
  • Status: “Resolved”.
  • A note reading “Data Destroyed”.
  • An update timestamp of Nov 2, 2026 11:51 AM UTC.

The source does not explain what “Resolved” or “Data Destroyed” mean for this entry.

RansomLook shows the obsoft group with six posts, all dated 2026-11-10. Each is labelled as a South Korean company and numbered #1 to #6.

Not confirmed: whether the victim has acknowledged an incident, whether any data was taken or encrypted, how access was gained, and whether the stated 45.2TB is accurate. RansomLook is a tracker of leak-site listings. No independent outlet or official source in the material confirms the claim.

Am I affected?

Only the masked domain www.gun.*.kr is named. The full domain is not confirmed, and the listing does not describe what data, if any, is involved. If you cannot tell from the mask whether the domain is yours or a partner’s, treat the question as open rather than assuming a match. The source does not say whether customers, employees or partners are affected.

What to do now

  1. Check whether the masked domain matches an organisation you run or depend on. If it does, tell your internal security contact.
  2. Ask the organisation or your own incident response team whether they have seen signs of intrusion. Do not rely on the leak-site listing as evidence either way.
  3. Check RansomLook’s obsoft page for updates, and wait for a statement from the organisation or an official source before drawing conclusions.
  4. Do not contact the group or visit its leak site. The sources give no guidance on that, and it is not needed to assess your own exposure.

Sources