stni.co.kr listed on DragonForce ransomware leak site

• Ransomware group: DragonForce
• Country: South Korea
• Announcement date: June 29, 2026

DragonForce claims data breach at stni.co.kr

The threat actor known as DragonForce has listed stni.co.kr on its leak site, alleging a significant data breach. According to the announcement published on June 29, 2026, the group claims to have obtained a substantial amount of information belonging to the organization. This incident follows a pattern of double extortion, a common ransomware tactic where attackers not only encrypt an organization's systems but also steal sensitive data to threaten its public release if a ransom is not paid.

The group's announcement references the specific activities of the victim company, particularly those related to the modeling and testing of technological processes. The threat actor alleges that the data was obtained following a security incident that occurred on June 28, 2026. While the group has published the organization's name on its leak site, no specific details regarding the content of the leaked data have been provided. The available information, such as the screenshot provided by the group, only displays the total data size and a description of the company's operational activities.

Details of the alleged data leak

The claims made by DragonForce regarding the scope of the breach focus primarily on the volume of information rather than the specific nature of the files. The group asserts that 6.04 GB of data was successfully exfiltrated during the attack. This volume of data can represent a significant amount of sensitive information depending on the file types involved.

Regarding the specific types of information compromised, the listing names no specific data types.

The organization profile

STNI is a South Korean engineering firm that specializes in creating virtual replicas, industrial modeling, testing, and optimizing technological processes. The company provides digital twin technologies and prototyping services through its production facilities and workshops. Given its focus on high-tech engineering and industrial modeling, the company operates in a sector where technical data and intellectual property are highly valuable.

Analysis and potential risks

This alleged leak may carry the risk of exposing sensitive technical data or intellectual property related to the company's operational processes. Because the organization is based in South Korea, any involvement of personal data could trigger legal proceedings under local data protection regulations. Furthermore, the nature of the company's work in digital twin technologies and industrial modeling means that leaked data could potentially be utilized for industrial espionage or supply chain attacks.

The operational model of DragonForce, which involves providing infrastructure to various affiliates, suggests that the attack may have been carried out by different actors using the group's platform. This complexity makes it difficult to determine the exact origin of the breach. Beyond the immediate loss of data, secondary risks may include targeted phishing campaigns using the leaked information and potential reputational damage to the firm.

For organizations operating in similar high-tech engineering sectors, several defensive steps are generally recommended to mitigate such risks. Implementing robust data loss prevention (DLP) tools can help monitor and prevent unauthorized transfers of sensitive technical files. Additionally, maintaining strict access controls and multi-factor authentication (MFA) can limit the ability of an attacker to move laterally through a network once they have gained initial access. Regular security awareness training is also vital to protect against the phishing attempts that often follow a data breach. Finally, maintaining comprehensive backups and a tested incident response plan is essential for recovering from the encryption phase of a ransomware attack.