Full Report
ASEC Blog publishes Ransom & Dark Web Issues Week 5, May 2025 New ransomware group DATACARRY emerges: Victim companies in 8 countries disclosed 65,000 records of Korean individuals leaked on cybercrime forum A South Korean university listed as a new victim of NOVA ransomware
Analysis Summary
This analysis extracts information from a weekly threat summary regarding ransomware and Dark Web activities observed in the fifth week of May 2025. Since the provided context is a threat intelligence overview rather than a single, contained incident report, the summary will focus on the *events and threats highlighted* within that summary period.
# Incident Report: Summary of Ransomware Activity - Week 5, May 2025
## Executive Summary
During the fifth week of May 2025, threat actors were active across multiple vectors, prominently featuring the emergence of the new DATACARRY ransomware group, which targeted victims across eight countries. Concurrently, data related to 65,000 Korean individuals was observed leaking on a cybercrime forum, and a South Korean university was identified as a new target for the NOVA ransomware strain.
## Incident Details
- **Discovery Date:** On or around May 29, 2025 (Date of Blog Publication)
- **Incident Date:** Activity spanned the fifth week of May 2025 (Specific start/end dates for individual attacks are not provided)
- **Affected Organization:** Multiple companies across 8 countries (DATACARRY); A South Korean university (NOVA); Unspecified entities whose PII was exposed (Data Leak)
- **Sector:** Various (including Education in the case of NOVA)
- **Geography:** Global, with specific impact noted in South Korea.
## Timeline of Events
The provided text lists concurrent observations rather than a single sequence of events.
### Initial Access
* **Vector:** Not explicitly detailed for all events; however, ransomware activity implies successful initial compromise. DATACARRY is a newly emerged group.
* **Details:** Attacks leading to the DATACARRY disclosures occurred across 8 countries.
### Lateral Movement
* (Not specified in the summary provided; assumed to be a necessary stage for ransomware deployment and data exfiltration.)
### Data Exfiltration/Impact
* **Impact:** 65,000 records belonging to Korean individuals were leaked on a cybercrime forum.
* **Impact:** A South Korean university was compromised and publicly listed as a victim by the NOVA ransomware group.
* **Impact:** DATACARRY ransomware group disclosed victims across 8 nations.
### Detection & Response
* **Detection:** Monitoring of Dark Web and cybercrime forums by ASEC.
* **Response actions taken:** Documentation and publication of these threats via the ASEC Blog (May 29, 2025) and related intelligence reporting (subscription to AhnLab TIP required for IOCs).
## Attack Methodology
The summary focuses on the *outcome* rather than the detailed technical methodology (TTPs).
- **Initial Access:** Not specified.
- **Persistence:** Not specified.
- **Privilege Escalation:** Not specified.
- **Defense Evasion:** Not specified.
- **Credential Access:** Not specified.
- **Discovery:** Not specified.
- **Lateral Movement:** Not specified.
- **Collection:** Data collection was successful leading to the exfiltration/leak of 65,000 South Korean PII records.
- **Exfiltration:** Data exposure occurred on cybercrime forums.
- **Impact:** Ransomware encryption implemented by DATACARRY and NOVA; Extortion via public data leaks.
## Impact Assessment
- **Financial:** Not specified (implied significant due to ransomware attacks).
- **Data Breach:** Leak of 65,000 records belonging to Korean individuals. Potential institutional data loss at the South Korean university victim.
- **Operational:** Implied disruption due to confirmed ransomware incidents (DATACARRY, NOVA).
- **Reputational:** Negative impact on the named university and potential damage to the affected companies in 8 countries.
## Indicators of Compromise
*Note: Specific IOCs are explicitly mentioned as requiring subscription to AhnLab TIP.*
- **Network indicators:** (Defanged) Not provided in the summary text.
- **File indicators:** (Defanged) Not provided in the summary text.
- **Behavioral indicators:** Identification of new ransomware groups (DATACARRY) and existing campaigns (NOVA).
## Response Actions
Response actions detailed are related to threat intelligence publishing, not specific containment/eradication actions for the victims.
- **Containment measures:** (Not specified).
- **Eradication steps:** (Not specified).
- **Recovery actions:** (Not specified).
## Lessons Learned
- The threat landscape remains volatile with new ransomware groups (DATACARRY) emerging rapidly.
- Cybercrime forums are active venues for the sale/release of stolen Personally Identifiable Information (PII).
- Critical organizations, such as universities, remain high-value targets for established ransomware operators (NOVA).
## Recommendations
- Organizations hosting sensitive PII (especially in South Korea) must immediately review their access controls and data security posture due to the large PII leak observed.
- Maintain up-to-date threat intelligence regarding emerging ransomware strains like DATACARRY.
- Implement robust defenses against tactics that lead to ransomware execution, particularly on educational networks.