EUSU Logistics Data Breach

SOCRadar threat intelligence has identified EUSU Logistics, a transportation company based in South Korea, as a potential victim of the N0n ransomware group. The group claimed to list EUSU Logistics on its dark web portal on October 12, 2026. This incident is part of a broader campaign by N0n targeting the maritime sector. SOCRadar’s analysis suggests that nine employee credentials belonging to EUSU Logistics were recovered from sampled stealer logs, indicating a multi-endpoint compromise. These compromised credentials were found across direct organizational access and third-party logistics platforms crucial to EUSU Logistics’ daily operations. N0n has been active in targeting organizations within the transportation, technology, and healthcare sectors, with a significant number of victims in the United States and South Korea. Over the past 60 days preceding this listing, N0n claimed approximately 72 victims. Notable organizations also associated with N0n’s activities in the transportation sector include Ocean Network Express (Singapore), CULines (China), T.S. Lines (Taiwan), and ZPMC (China), which operates in the manufacturing industry. This pattern suggests a consistent focus on global logistics and supply chain entities.

SOCRadar’s investigation into EUSU Logistics revealed nine employee credentials recovered from sampled stealer logs. These records indicate compromised access points across both direct organizational platforms and third-party logistics systems utilized by the company. The compromise appears to be at the workstation level, affecting multiple endpoints. The presence of both corporate and third-party service credentials suggests that the infected machines were actively harvesting credentials from all connected platforms. The recovery of these credentials from stealer logs is a significant indicator of potential initial access for ransomware operations. While this telemetry does not confirm a full-scale ransomware deployment, it strongly suggests that the N0n group has obtained the necessary access and information to proceed with an attack. The multi-endpoint compromise and the harvesting of credentials from various platforms increase the risk of further lateral movement and data exfiltration within EUSU Logistics’ network. Given the observed indicators, immediate action is required to mitigate the potential impact of this threat. Organizations should focus on rotating all exposed credentials, auditing VPN and SSO access logs for suspicious activity, and enforcing phishing-resistant multi-factor authentication. A thorough review of third-party logistics portal access logs for unauthorized sessions is also recommended to identify any ongoing malicious activity. Proactive security measures are crucial to prevent a full ransomware deployment.