ULOSE
Data as of September 30, 2026.
What industries ULOSE targets
Sector identified for 4 of 6 victims.
| Manufacturing | 1 | |
| Education | 1 | |
| Financial Services | 1 | |
| Healthcare | 1 |
Where the victims are located
Country identified for all 6 victims.
| South Korea | 6 |
Every ULOSE victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Handok handok.co.kr | Not identified | South Korea | Sep 30, 2026 |
| Hize Aero hizeaero.com | Manufacturing | South Korea | Sep 30, 2026 |
| Kyungrok kyungrok.com | Education | South Korea | Sep 30, 2026 |
| MSI money-store.co.kr | Financial Services | South Korea | Sep 30, 2026 |
| Seoul Hyocheon Medical Foundation newyjh.com | Healthcare | South Korea | Sep 30, 2026 |
| NR Capital nrcapital.co.kr | Not identified | South Korea | Sep 30, 2026 |
Browse recent data breaches for more.
ULOSE leak site
The address we've seen ULOSE publish victims from. Any .onion address needs the Tor Browser.
egm34gsyx65wb6jyqds4esvkskl34barx4robuebjhqpc4dfeavg7fyd.onion
ULOSE questions
Is ULOSE still active?
Yes. ULOSE posted its most recent victim on September 30, 2026. That's 6 victims in the last 30 days.
How many victims has ULOSE claimed?
ULOSE has named 6 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did ULOSE first appear?
The first victim we recorded for ULOSE was posted on September 30, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Has ULOSE already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.