✅ Report Title:
Threat Actor Profiling: hize_hacker (a.k.a. @ULOSE)

📌 Who Is hize_hacker?

• On June 28, 2024, they joined the dark web hacking forum Leakbase under the nickname Iburaham.muhame and started their forum activities.
  • Activity history has been confirmed in other DDW forums such as Darknet Army, BHF, Leakzone, and Darkforums, in addition to Leakbase.
    • They use multiple usernames and create several accounts for each forum, with each account being active for a short period.
  • They operated a Telegram channel for data leaks and sales and uploaded samples of compromised data to the channel.
  • Operating a DLS (Dedicated Leak Site) called ULOSE, they collect and leak compromised data of victim companies that were previously shared across various hacking forums.

📌 hize_hacker's Activity Patterns

• Mainly conducts attacks targeting South Korea, and uploads posts selling compromised data using both English and Korean.
• Among South Korean companies and institutions, a hospital (2025-07-26), a real estate exam education institution (2025-08-03), an aircraft parts manufacturing company (2025-09-08), a law firm (2025-09-22), a lending company (2026-03-10), another lending company (2026-03-25), and a pharmaceutical company (2026-04-06) have been targeted.
• Analysis of post and comment timestamps shows activity mainly occurring between 18:00 and 0:00 the following day (UTC+9), with the highest frequency of activity at 22:00.
  • Given the primary targets and activity hours, it is highly likely that the actor is operating out of South Korea.

📌 hize_hacker's Attack Patterns

• hize_hacker is presumed to be a data extortion-type threat actor that generates revenue through large-scale data theft and leaks targeting Korean companies, continuing data sales activities based on its own DLS, ULOSE.
  • Given that leaked data from the same victim companies was posted around similar timeframes and the same samples were shared, it is possible they were an affiliate of, or in a cooperative relationship with, the ransomware group Gunra.

✅ Threat Detection Recommendations and Mitigation Measures

• The hize_hacker user mainly carries out attacks targeting Korea, and is presumed to primarily aim for financial gain by compromising large volumes of data and then selling it. They have been confirmed to directly operate a DLS site called ULOSE, which shows characteristics similar to activity patterns commonly observed among ransomware and data extortion groups.
  • Since there is a possibility of evolving into organized attack activities through the use of encryption tools or the operation of a RaaS (Ransomware-as-a-Service), continuous monitoring is necessary.
• Infiltration evidence screenshots confirm that data was compromised through direct access to the victim company's PDM and DB servers; however, due to the lack of data on the access process and the tools used, it is difficult to identify the specific initial infiltration route and attack techniques.
  • Server access should be restricted through the principle of least privilege and network segmentation, and abnormal access should be monitored in real time with an intrusion detection system.