November 2025 Security Issues in Korean and Global Financial Sector

This report summarizes multiple active threats targeting the financial sector: bank customer records (including PII and IBANs) being sold by a threat actor on forums, Clop ransomware activity that leveraged an Oracle E-Business Suite zero-day (CVE-2025-61882) to exfiltrate data from insurance/financial organizations, and ongoing phishing and malware campaigns impacting Korean and global financial institutions; the document also provides industry leak statistics, MD5 IOCs, and recommends patching, MFA, access log monitoring, and tighter cyber insurance controls.