New 'Midnight' and 'Endpoint' Ransomware Spreading in South Korea; Attackers Impersonate IT Firms

South Korean cybersecurity agencies, including the National Police Agency and the Korea Internet & Security Agency (KISA), have issued a stark warning about the escalating threat of 'Midnight' and 'Endpoint' ransomware. These sophisticated attacks are specifically targeting our nation's vital small and medium-sized enterprises (SMEs), which form the backbone of our economy.

The modus operandi is particularly insidious. Cybercriminals are posing as trusted IT service providers, using deceptive emails for 'quotes, job applications, or consulting requests' to gain initial access. Once inside, they pilfer internal and account information. The second wave of attack involves impersonating the compromised IT firm to target its clients, effectively using a trusted relationship as a weapon.

“

The victims include many small and medium-sized manufacturers, and damage has also been confirmed in distribution, energy, and public institutions, so caution is needed across all industries.

What makes this threat particularly alarming is the 'double extortion' method. It's not just about encrypting files; attackers are stealing data first and then demanding payment, threatening to leak sensitive information. This significantly raises the stakes for victimized companies, creating immense pressure to comply. The scope of the threat is broad, affecting not only manufacturing SMEs but also distribution, energy, and even public institutions, underscoring the need for vigilance across all sectors.

In response, the police and KISA have collaborated to develop and distribute comprehensive advisories, detailing attack methods, types, and countermeasures. This marks a significant step in proactive defense, with the police officially issuing security recommendations based on investigative intelligence. South Korea is committed to swiftly sharing threat information and bolstering our defenses against these evolving cyber threats.

“

We are currently investigating attacks related to this ransomware and plan to quickly share additional threat information with related agencies and companies.