Ransomware needs a way in. Stolen credentials are the cheapest one.

Hanwha Renewables Ransomware Attack

hanwharenewables.comRansomed

emperadorGroup

South KoreaCountry

Aug 28, 2026Discovered

Data has been published on the ransomware group's leak site.

Overview

View group profile

Domain

hanwharenewables.com

Industry

Energy & Utilities

Country

South Korea

Discovered

21 days ago

Attack date

Aug 28, 2026

Confidence

100%

Severity

Critical

Status

Data Leaked

Threat group

emperador

Total victims

First seen

Aug 2026

Last seen

Sep 2026

Group status

active

Sophistication

Impact score

Threat level

4.5/10

Aggressiveness10/10

Lethality0.7/10

Criticality2.5/10

Status breakdown

Data Leaked

this victim

5.1%3

Negotiating1.7%1

Claimed93.2%55

Targeted sectors

Education Energy & Utilities Government & Defense Manufacturing Other Professional Services Technology Transportation

Victim's position within group

Industry

Energy & Utilities

Known target sector

Country

South Korea

Not a listed target country

Other victims

View all (59)

Same group · emperador

Group activity

Monthly attacks · emperador

total · avg 29/mo