Recent cybersecurity incidents include a data breach affecting South Korean diplomats, a major loss for Ostium DEX, and the shutdown of a phishing service.
This past week has seen notable incidents in cybersecurity, underscoring the ongoing threats faced by various sectors.
- A cyberattack on South Korea's diplomatic academy potentially compromised data of around 6,000 diplomats.
- The Dolphin X Trojan leveraged AI to evaluate infected devices and prioritize targets for cyberattacks.
- Ostium DEX suffered a substantial financial hit of $23.75 million due to an exploit in its off-chain infrastructure.
- Swiss train manufacturer Stadler refused to pay a $12.2 million ransom demanded by hackers.
Data Breach of South Korean Diplomats
The South Korean Ministry of Foreign Affairs confirmed a significant data breach at its diplomatic academy, which is believed to have been executed by North Korean hackers taking advantage of a zero-day vulnerability. The attack, occurring between April and May 2025, remained undetected until February 2026, exposing educational materials and personal data of approximately 6,000 diplomats.
Dolphin X Trojan Uses AI for Targeting Victims
The newly identified Dolphin X Trojan employs artificial intelligence to categorize and score infected devices, as reported by analyst Daniel Kelly from Varonis. This malware automates the evaluation of compromised systems, prioritizing those with access to corporate networks and significant cryptocurrency wallets. Unlike traditional phishing methods, Dolphin X uses neural networks to analyze stolen data and assess the value of the devices it infects.
Ostium DEX Hit by $23.75 Million Theft
The decentralized exchange Ostium reported a loss of $23.75 million due to an attack on its off-chain price oracle infrastructure. Trading has been halted since July 16, following the incident where the attacker manipulated price data, creating artificial profits at the expense of liquidity providers. The stolen funds were reportedly converted into ETH and sent to a mixer.
Stadler Refuses Ransom Demand from Hackers
Stadler Rail, a prominent Swiss train manufacturer, disclosed an extortion attempt where hackers demanded 10 million Swiss francs (around $12.2 million). The company, having previously faced a cyberattack in 2020, opted not to pay the ransom and instead reported the incident to law enforcement. The breach involved a third-party data exchange platform but did not compromise critical internal systems.
Kratos Phishing Service Dismantled by Law Enforcement
A joint operation by law enforcement in Germany and the U.S. led to the shutdown of Kratos, a major phishing-as-a-service platform. This service, which had around 1,800 customers and was responsible for 15,000 phishing campaigns monthly, utilized sophisticated techniques to bypass two-factor authentication and target organizations across various sectors. Despite the takedown, experts warn that the service's source code may still be in circulation, potentially leading to future attacks.
Adobe Acrobat Extension Vulnerability Exposed User Data
Researchers at Guardio Labs identified a vulnerability in the Adobe Acrobat extension for Chrome that allowed attackers to silently access user data from WhatsApp Web. By directing users to a malicious page, hackers could exploit the extension to steal sensitive information without the need for traditional malware installation. Experts recommend updating the extension to mitigate this risk.
