ReversingLabs blog
GwisinLocker ransomware targets South Korean industrial and pharma firms · 2022-08-09T05:00:00.000Z
On July 19th in the course of threat hunting, ReversingLabs researchers discovered an undetected Linux ransomware sample which bore the markers of a Gwisin campaign. ... That could suggest that Gwisin group is a North Korea based threat actor, given that nation’s aggressive use of offensive hacking, including the use of ransomware, to target South Korean government agencies and private sector firms.