South Korea
East Asia · capital Seoul · cyber picture, physical security and relations with the EU on one page
Who targets South Korea
All 26 actors →
China (13) · 
North Korea (4) · 
Russia (3) · 
Iran (2) · South Korea (1)| Actor | Suspected sponsor | In its news · 30d | Techniques |
|---|---|---|---|
| TraderTraitor named in the news only | North Korea |
12 | — |
| Lazarus Group | North Korea |
3 | 30 |
| Storm-0940 named in the news only | China |
1 | — |
| Kimsuky named in the news only | North Korea |
1 | 130 |
| WageMole named in the news only | North Korea |
1 | 54 |
| MUSTANG PANDA named in the news only | China |
1 | 28 |
| Pearl Sleet named in the news only | North Korea |
1 | — |
| UNC3569 named in the news only | China |
1 | — |
| APT29 | Russia |
— | 66 |
| APT27 | China |
— | 57 |
| APT10 | China |
— | 46 |
| Tick | China |
— | 40 |
Cyber news 30 days
Every cyber article that mentions it →- Samsung SDS subsidiary Multicampus hacked, personal information of about 70,000 employees leaked KO
- 150,000 personal records leaked in hacking of 4 Samyang Group companies... includes 80,000 resident registration numbers KO
- [POC 2026] Devcore demonstrates Safari 26.5 hacking... reveals WebKit vulnerability research KO
- Virtual asset exchange Flybit hacked, resident registration numbers and tax information of 40 customers leaked KO
- S. Korea, Belgium discuss leak of personal data of President Lee, Europe trip entourage
- 'National functions continue even if hacked'... Pan-government task force for national cyber resilience launched KO
- [FSA Hacking-2] Financial Security Institute claims 'we do not collect security details'... but their own manual requires vulnerability measures, firewall blocking policies, and even network separation diagrams KO
- Certification authority 'DigiCert' internal system hacked... customer business contacts and some passports and licenses leaked KO
- [FSA Hacking-3] Financial Security Institute hacking, the Financial Services Commission that entrusted them cannot avoid responsibility... must also examine oversight responsibility for regular evaluations KO
- GS E&C apartment resident personal information leak... first subject of ex officio investigation after refusing to consent to government investigation KO
Exploited vulnerabilities in its news 90 days
- CVE-2026-109618
- CVE-2026-109619
- CVE-2026-21589
- CVE-2026-0257 Ransomware
- CVE-2026-63077 Ransomware
- CVE-2016-6210
- CVE-2026-45659 Ransomware
- CVE-2026-59310 Ransomware
Incidents
Register →- Moderate Personal information leaked at Secta9ine, a subsidiary of 'Happy Point operator' SPC Group Detected
- Elevated Xen Orchestrator authentication bypass actually exploited... virtualization hosts can also be compromised Detected
- Elevated 'National functions continue even if hacked'... Pan-government task force for national cyber resilience launched Detected
- Elevated S. Korea, Belgium discuss leak of personal data of President Lee, Europe trip entourage Detected
- Elevated Virtual asset exchange Flybit hacked, resident registration numbers and tax information of 40 customers leaked Detected
- Moderate 150,000 personal records leaked in hacking of 4 Samyang Group companies... includes 80,000 resident registration numbers Detected
- Moderate Samsung SDS subsidiary Multicampus hacked, personal information of about 70,000 employees leaked Detected
- Elevated Government conducts ex officio investigation into GS E&C over 'Xi' resident information leak... first case decided after deliberation Detected
National CERT advisories
All →- Security update recommendation for React Server Components KO
- Security update recommendation for Apache products KO
- Security update recommendation for WordPress plugins KO
- Security update recommendation for Node.js products KO
- Security update recommendation for Zoom products KO
- Security update recommendation for Synology products KO
Cyber threat landscape as described in the country report of Nov 11 Machine-generated
South Korea's cyber threat landscape remained highly active during this period, with both state-sponsored and criminal actors implicated in significant incidents. US investigators have linked the $6.3 billion Binance cryptocurrency theft, which occurred around October 29, to North Korean hackers. This incident, alongside renewed concerns over North Korean hacking activities, prompted South Korean President Lee Jae Myung to call for a powerful "cybersecurity czar" to coordinate national defenses and ordered comprehensive security checks across the financial sector. The National Intelligence Service (NIS) also initiated emergency security inspections across 2,100 government ministries and public institutions.
A notable incident this week was the data breach at South Korea's Financial Security Institute (FSI), detected on November 10 or 11, 2026. This breach exposed personal information of local bankers and potentially security status data of financial firms, as hackers targeted a regulator's website used for security assessments. Additionally, police launched an investigation into the online leak of personal information, including passport details, of 168 individuals who traveled on the presidential aircraft in June, highlighting vulnerabilities in government data handling. The Financial Services Commission (FSC) responded to a broader trend of cyberattacks, with 40 hacking cases reported at 37 financial companies since September 30, by announcing new November guidelines requiring virtual-asset service providers to immediately report hacking incidents to financial authorities. Earlier in October, incidents also targeted brokerage Daishin Securities, asset manager Mirae Asset Global Investments, and crypto exchange Bithumb, with Daishin confirming the exposure of data for 38,490 customers.
No specific exploited vulnerabilities (CVEs) from the provided list were explicitly named in the news for this period. However, security researchers linked a previous wave of attacks in September against financial institutions to a hacker suspected of operating out of China, reportedly utilizing an AI-based offensive pentesting tool called Artex. Background: Threat actors known to target South Korea include Lazarus Group (North Korea-linked), APT29 (Russia-linked), APT27 (China-linked), APT10 (China-linked), Tick (China-linked), and TA505 (Russia-linked). Threat actors named in news in the last 30 days include TraderTraitor, Lazarus Group, Kimsuky, WageMole, MUSTANG PANDA, and Pearl Sleet.
Hotspots from the country report of Nov 11
Machine-generated- High Korean Peninsula (DMZ/NLL) — Ongoing North Korean military provocations, missile launches, and border fortification efforts create persistent tension and risk of escalation.
- Elevated East Sea (Sea of Japan) — Site of multiple North Korean missile launches, posing a threat to maritime security and regional stability.
- Elevated Strait of Hormuz — South Korea's non-combat military deployment to protect commercial shipping amidst the US-Iran war introduces potential exposure to regional conflict.
- High Seoul (Financial District) — Concentration of cyber incidents and data breaches targeting financial institutions and government agencies, indicating high cyber threat activity.
- Elevated Sondok, North Korea — Launch site for North Korean missiles on November 4, demonstrating active military testing and development.
Threat level last reports
Machine-generatedLatest country report
Read the full report →Relations with the EU
Factsheet →Mentioned 7 times in latest briefing. Last updated: 2026-08-22
- 8 EU cooperation projects · 8 active
- 2 EU Digital & ICT projects: cyber activity here touches EU digital cooperation
- 1 trade or cooperation agreement on record
EU relations and implications country report of Nov 11
Machine-generatedNo significant direct news regarding South Korea's relations with the European Union was reported during the period of November 04 to November 11, 2026. The EU relationship outlook, as assessed in August 2026, remains stable, with ongoing cooperation projects in sectors such as Research & Innovation, Digital & ICT, Trade & Investment, Peace & Security, and Education & Skills. Key digital projects include the EU-South Korea Digital Partnership Council and the EU-South Korea Digital Trade Agreement (DTA).
Despite the absence of direct news, the security and cyber developments in South Korea during this period have indirect implications for EU interests. The heightened cyber threat landscape, characterized by significant data breaches at financial institutions and government entities, could pose risks to EU businesses and citizens operating or residing in South Korea, particularly given the EU's strong emphasis on data protection. The EU's cooperation projects in Digital & ICT and Trade & Investment would necessitate robust cybersecurity measures to safeguard shared digital infrastructure and trade data. Furthermore, North Korea's continued military provocations and the broader geopolitical instability on the Korean Peninsula, while not directly involving the EU, underscore the importance of the EU's Peace & Security cooperation with South Korea, potentially requiring closer dialogue on regional stability and non-proliferation efforts.
| Agreement | Type | Budget | Organisation | Period | Status | |
|---|---|---|---|---|---|---|
| EU-South Korea Free Trade Agreement | Free Trade Agreement | — | Asia-Pacific | 2015 | ACTIVE | Source ↗ |
Previous reports
Machine-generated- South Korea Security Report — November 10, 2026
- South Korea Security Report — November 08, 2026
- South Korea Security Report — November 07, 2026
- South Korea Security Report — November 05, 2026
- South Korea Security Report — November 02, 2026
- South Korea Security Report — November 01, 2026
- South Korea Security Report — October 31, 2026
- South Korea Security Report — October 29, 2026
- South Korea Security Report — October 28, 2026
- South Korea Security Report — October 27, 2026