VULNpocalypse
LowBreach / campaignMonitoring

RansomLook reports obsoft ransomware group lists South Korean Company #5

RansomLook reports the obsoft ransomware group lists a South Korean site as Company #5; the victim’s position is not confirmed, so await its notice.

Published
Exploitation
No confirmation. Only a leak-site listing tracked by RansomLook, with no victim statement or technical evidence in the sources.

What happened

According to RansomLook, a site that tracks ransomware leak sites, the obsoft group has claimed an entry titled “Company #5 www.mi*nho**al..kr” on its leak site. RansomLook: Obsoft group page The domain is partly masked in the listing, and this advisory does not try to unmask it. The headline for this story comes from the same RansomLook page and is dated 2026-11-10. RansomLook: Company #5 claimed by the obsoft ransomware group

The RansomLook page lists these details for the entry:

  • Country: South Korea.
  • Size: 17.5TB.
  • Status: “Resolved”.
  • A note reading “Data Destroyed”.
  • An “Updated” timestamp of Oct 20, 2026 2:26 PM UTC.

RansomLook also shows the obsoft group with 6 posts, all dated 2026-11-10, and Company #5 is one of them. RansomLook: Obsoft group page

What is not confirmed:

  • The organisation’s position is not confirmed. No source here carries a statement from it, either confirming or denying an incident.
  • No independent outlet has verified the claim. The only source is a claim tracker.
  • Whether the 17.5TB size listed on the page is accurate is not confirmed.
  • The entry point, the type of data involved and whether any data was actually taken are not confirmed.
  • What “Resolved” and “Data Destroyed” mean is not explained in the source.

Am I affected?

Not confirmed. A listing on a leak site is a claim, not proof of a breach. The organisation is only identified by a masked domain and the country South Korea, so the sources do not let you tell whether you are affected. If you are a customer, member or partner of a South Korean organisation whose domain matches the masked pattern, treat its own communications as the authoritative source. The sources give no CVE, software product or vulnerability linked to this claim.

What to do now

  1. Wait for an official statement from the organisation or a relevant national authority before treating this as a confirmed incident. None is cited in the sources.
  2. If you deal with the organisation, check its official website and notices for any disclosure, rather than relying on the leak-site listing.
  3. Check back for updates. This advisory will be revised if the organisation or an independent source confirms or denies the claim.

Sources