VULNpocalypse
LowBreach / campaignMonitoring

Obsoft ransomware group claims Korean victim ui****gb****n.**.kr

RansomLook reports the obsoft ransomware group lists a South Korean site as a victim, the claim is unconfirmed, so verify with the organization.

Published
Exploitation
No confirmation. Only a leak-site listing tracked by RansomLook, no victim statement or independent verification in the sources.

What happened

RansomLook, a ransomware leak-site tracker, reports that the obsoft ransomware group lists “Company #3 www.ui**gbn..kr” on its leak site. The group’s page on RansomLook shows the entry dated 2026-11-10. RansomLook

According to that listing, as shown by RansomLook:

  • Country: South Korea.
  • Size: 7.8TB.
  • Updated: Oct 28, 2026 11:47 AM UTC. The page does not say who made this update.
  • Status field: “Resolved”, with the note “Data Destroyed”.

The domain is masked in the listing, so the full name of the organization is not confirmed. The page does not explain what “Resolved” or “Data Destroyed” mean. RansomLook

RansomLook shows 6 posts from the obsoft group, all dated 2026-11-10. Each one is a South Korean company entry. RansomLook

What is not confirmed:

  • The sources contain no statement from the organization confirming or denying an incident.
  • There is no independent verification that any data was taken, encrypted or destroyed.
  • The entry point, the type of data and the real data volume are not confirmed.
  • No official advisory or news report on this claim was provided. The only source is the tracker’s copy of the group’s own listing.

Am I affected?

Only the masked domain “www.ui**gbn..kr” is named, and the sources do not identify the organization behind it. Nothing in the sources points to any product, vulnerability or CVE. If you are not connected to that organization, the sources give no reason to take action.

If you are connected to it, the listing is a claim, not proof of a breach. Whether your data is involved is not confirmed.

What to do now

  1. Treat the listing as an unverified claim. Do not treat it as confirmed, and do not contact or pay the group on the strength of it.
  2. If you represent the organization, check your own logs and incident records and ask your security team or provider whether anything matches. This step is general practice, not something the sources state.
  3. If you are a customer or partner, wait for a statement from the organization itself. None is present in the sources.
  4. Check the RansomLook group page for changes to the entry. RansomLook

Sources