The article attributes the Korean Leaks campaign to North Korea-linked Moonstone Sleet using Qilin ransomware infrastructure after compromising South Korean MSP GJTec. The intrusion reportedly exposed more than one million files totaling over 2 TB across 28 asset-management firms, including investor, employee, tax, strategic, and financial information. Stolen data was released through Qilin's leak site in three waves between September 14 and October 4, 2025, with early geopolitical messaging later giving way to conventional extortion. The operation demonstrates how privileged MSP access can amplify a state-linked ransomware campaign across a concentrated financial-sector customer base.