Kernelware
Attribution profile
- Type
- Sensationalist
- Location
- Viet Nam
- Known incidents
- 5 incidents
- Sources
- 5 sources
- First seen
- 2023-02-15
- Last seen
- 2023-03-14
- Updated
- 2026-10-13 09:09
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Kernelware, also known by the alias Kernelware, is a threat actor linked to Vietnam who has publicly leaked data from multiple organizations via BreachForums. The actor has targeted Vietnamese state‑owned petroleum and infrastructure firms (PetroVietnam, Long Son Petrochemicals, POSCO Engineering & Construction), an Indian financial subsidiary (HDB Financial Services), a Taiwanese technology company (Acer), and a Swiss cybersecurity firm (Acronis). Kernelware states that the leaks are released for free without ransom demands, citing boredom and personal amusement rather than financial gain, and has acknowledged errors in attribution while noting a temporary hiatus due to academic obligations. No specific malware families, initial‑access vectors, or tooling styles are described in the available reporting, and no state or criminal‑group affiliation has been publicly established. Representative operations include the March 2023 disclosure of infrastructure schematics and employee data from the Vietnamese petroleum group, the March 2023 release of ~73 million customer records from HDB Financial Services, the February‑March 2023 offering of 160 GB of Acer technical documents, and the March 2023 leak of a single customer’s Acronis support data.
Incidents
Attributed incidents are available to members.
5 incidentsSources
Sources available to members: 5 sources.