<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title>South Korea - Tag - Maritimeinfosec.org</title><link>https://maritimeinfosec.org/tags/south-korea/</link><description>South Korea - Tag - Maritimeinfosec.org</description><generator>Hugo -- gohugo.io</generator><language>en-US</language><copyright>Copyright Maritimeinfosec.org 2018-2026</copyright><lastBuildDate>Thu, 15 Oct 2026 09:20:00 +0200</lastBuildDate><atom:link href="https://maritimeinfosec.org/tags/south-korea/" rel="self" type="application/rss+xml"/><item><title>n0n: 34 maritime and port organisations listed on 12 October</title><link>https://maritimeinfosec.org/n0n-34-maritime-and-port-organisations-listed-on-12-october/</link><pubDate>Thu, 15 Oct 2026 09:20:00 +0200</pubDate><author>Olivier JACQ</author><guid>https://maritimeinfosec.org/n0n-34-maritime-and-port-organisations-listed-on-12-october/</guid><description><![CDATA[<p>On 12 October 2026, between 13:53 and 14:16 UTC, the <em>leak site</em> of a recent cybercriminal group calling itself n0n listed 38 organisations <a href="https://theloadstar.com/cyber-crime-group-hits-38-shipping-and-port-groups-with-date-leak-threat/" target="_blank" rel="noopener noreferrer ">[1]</a> <a href="https://maritime-executive.com/article/massive-cyber-attack-threatens-release-of-data-from-38-maritime-companies" target="_blank" rel="noopener noreferrer ">[2]</a>. Each entry carries the mention &ldquo;unpaid&rdquo;. These listings rest solely on the group&rsquo;s own claim, which no victim has confirmed to my knowledge. Of the 38 organisations named, 34 belong to shipping, ports and terminals.</p>
<h2 id="a-group-first-seen-on-18-september-2026">A group first seen on 18 September 2026</h2>
<p>The group has been publicly active for less than a month, which calls for caution about its origin and methods. Its first activity is detected on 18 September 2026, and its leak site, reachable through Tor, appears on the 21st. By the 22nd it already claims more than a dozen victims <a href="https://www.infosecurity-magazine.com/news/ransomware-gang-uses-backup/" target="_blank" rel="noopener noreferrer ">[3]</a>. They include a customer relations provider (87 million records claimed) and a Venezuelan internet access provider. SOCRadar counts 21 victims in 17 countries before the maritime batch, most of them outside the sector, and places the group probably in Russia. No link to an earlier group is documented.</p>]]></description></item></channel></rss>