DDW Weekly Highlights in September W4

• Confidential documents related to North Korea, leaked from the U.S. Department of Defense, are being sold on the dark web forum BreachForums.

• On September 24, a threat actor, "nexwl," listed classified U.S. documents concerning North Korea’s ICBMs (Intercontinental Ballistic Missiles) for sale.

• A sample was shared via a link, showing a screenshot of the first page. The full document is estimated to be eight pages long, with the first page displaying the title, creation date (May), document code, and confidentiality statement.

• A major South Korean tire manufacturer, K, has likely been targeted by a ransomware attack, leading to a data leak.

• On September 25, the LockBit ransomware group posted details of the breach, listing stolen data including financial records, payroll, emails, and IT information.

• Screenshots of some leaked data, appearing to be internal company documents, were also shared.

• On September 3, a post on the Russian dark web forum XSS had been seeking to purchase access to K’s internal network.

• Chinese flight ticket information is being sold on BreachForums.

• On September 26, a threat actor, "samkk," offered data including names, IDs, contact details, and airports used by Chinese travelers (departure and arrival).

• The seller claimed the data is real-time, indicating the source may still be compromised.