Qilin Member Gives Two Days to South Korean Company SK Group for Ransom Payment
Published on April 10, 2025
- The Qilin ransomware group named a South Korean multinational conglomerate as its victim on the dark web
- They allegedly stole 1 TB of data from the SK Group and posted about it on their leak site
- There is no official statement about the said incident by the company yet, nor has the authenticity of the post been verified
SK Group, a South Korean manufacturing and services conglomerate, has been named a ransomware victim on the dark web. The Qilin ransomware group claimed responsibility for the alleged cyber attack on April 10.
Cybersecurity Analyst Dominic Alvieri shared the threat intelligence on X. Headquartered in Seoul, SK Group is second to the Samsung Group in revenue in South Korea.
Qilin wrote, “Over 1 TB of files downloaded from their servers. Company has 48 hours to contact us before we published the data.”
It is not clear if Qilin was denied a ransom, following which they took to the dark web to threaten and pressure the company.
Displaying knowledge about the financial investments of the targeted company, Qilin wrote that the SK Group was investing in businesses and expanding its local operations in electric vehicle batteries, life sciences, technology, and more.
Based on the currently available details, it is not clear how the hackers gained access to the 1TB of data they claim to have stolen from the company. Nor is the ransom amount noted in the threat intelligence posts.
We approached the company for a comment about the security incident. We will update this report upon receiving a response from them.
Qilin recently posted about extorting SMC Corporation, a Japanese company. They allegedly targeted the company’s European corporate and customer data. Similar to the SK Group breach, in this incident, they exfiltrated about 1TB of data.
Threat intelligence firm Cyble noted in its report that Qilin, also known as Agenda, offers its ransomware to other cybercriminals in exchange for a share of the ransom. Following a ransomware-as-a-service (RaaS) model, the group uses valid account details to gain initial access.
“These accounts are often obtained through leaked credentials or purchased on underground forums,” read the Cyble report.
Related
Most Popular
Most Popular