VULNpocalypse
LowBreach / campaignMonitoring

Obsoft ransomware group claims attack on South Korean organization

RansomLook says obsoft lists a masked South Korean site as a victim; unconfirmed, so check your own exposure if it is yours.

Published
Exploitation
No evidence in the sources; this is an unverified leak-site claim only

What happened

According to RansomLook, a ransomware tracker, the group named obsoft has listed an entry titled “Company #4 www.t*hoal..kr” on its leak site. RansomLook dates the post 2026-11-10. This is the group’s own claim as recorded by the tracker. The victim has not confirmed it, and no source gives independent verification.

RansomLook records these fields for the entry:

  • Country: South Korea.
  • Size: 18.8TB.
  • Status: Resolved.
  • Updated: Oct 23, 2026 1:27 PM UTC.
  • Note: “Data Destroyed”.

The sources do not explain what “Resolved” or “Data Destroyed” mean in this context. The domain is partly masked, so the victim’s name is not confirmed.

The same RansomLook page lists six posts for obsoft, all dated 2026-11-10. They are labelled Company #1 to Company #6, and RansomLook gives South Korea as the country for each. The sources do not say how the group got in, what was taken, or whether any data has been published. They also give no ransom demand and no technical details.

Am I affected?

Not confirmed. The only source is a tracker entry that repeats the group’s listing. It does not name the organization in full, and it gives no technical indicators, software, vulnerability or entry point.

You may be affected only if you run the organization behind the masked domain, or if you share data or systems with it. For anyone else, the sources give no reason for action.

What to do now

  1. If you think the masked domain is yours, check your own logs and backups for signs of intrusion, and consult your incident response contacts. The sources do not say whether the claim is true.
  2. If you are a partner or customer of that organization, ask it directly for a statement. As of the sources, it has not publicly confirmed or denied the claim.
  3. Treat the claim as unverified until the organization or an independent party confirms it. Check RansomLook for updates to the entry.

Sources