PANAX Group

# PANAX GROUP / UKSEUNG Chemical (욱성화학) — South Korea **Industry:** Chemical Manufacturing, Industrial Automation (SCADA/PCS7), Nuclear Infrastructure Supplier **Revenue:** ~$141M USD/year (Group Total) **Headquarters:** Busan, South Korea **Websites:** ukseung.co.kr | panaxworld.com | panaxholdings.co.kr **Employees:** 679 (Active Directory) --- ## About PANAX GROUP is a South Korean industrial conglomerate based in Busan, operating since 1969. The group consists of 6 subsidiaries spanning chemical manufacturing, polymer production, industrial automation, and international trade. Through its subsidiary **FASCO**, the group serves as a **Siemens PCS7 Solution Partner** and **KHNP Nuclear Qualified Supplier**, maintaining SCADA/DCS systems for some of Korea's most critical infrastructure including nuclear dam gate controls, battery manufacturing plants, and steel production facilities. ### Group Structure: - **UKSEUNG Chemical (욱성화학)** — Organic pigments, resins, coatings - **BUSEONG POLYCOM (부성폴리콤)** — Polymer/chemical - **ETEC (이텍)** — Technology - **FASCO (파스코)** — Factory automation, SCADA integration - **PANAX Energy** — Energy services - **UK Seung Europe** — European trade operations --- ## Data Exfiltrated The complete digital infrastructure of PANAX GROUP has been compromised. The following data has been collected and verified: ### Active Directory — Complete Domain Dump Full NTDS.dit extraction containing **679 user accounts** and **784 computer accounts** across **6 corporate domains**: - panaxworld.com (Primary) - panax.local - ukseung.co.kr - efasco.co.kr - panaxetec.co.kr - panaxenergy.co.kr Includes Domain Administrator, krbtgt, CFO, and all privileged accounts. 235 accounts use the same default password. ### Network Infrastructure Complete internal network mapping covering 12+ subnets. Key servers identified: - SQL Server (ERP) with SA credentials - File Servers - SCADA Project Server - Backup Server - Multiple Domain Controllers - Hyper-V Cluster No network segmentation between IT and OT/SCADA environments. ### SCADA / Industrial Control Systems **FASCO maintains SCADA/DCS systems for major Korean industrial clients:** | Client | Sector | System | |---|---|---| | **Samsung SDI (삼성SDI)** | Battery Manufacturing | PCS7 Air Compressor Control | | **Hyundai Steel (현대제철)** | Steel Production | PLC Replacement | | **KHNP (한국수력원자력)** | **Nuclear — Dam Gate Control** | PCS7 DCS | | **EcoPro (에코프로)** | Battery Materials | Inverter Control | | **LG Chem (LG화학)** | Chemical | DCS Maintenance | | **POSCO** | Steel/Energy | Substation Monitoring | | **Celltrion (셀트리온)** | Pharmaceutical | Crater Project | Active SCADA credentials recovered — including operator accounts with **full plant control** capability, engineer accounts, WinCC HMI passwords, and PCS7 virtual machine images with empty Administrator passwords. ### Nuclear Infrastructure FASCO is a **KHNP (Korea Hydro & Nuclear Power) certified supplier** for nuclear facility I&C systems. Recovered documents include: - **Cheongpyeong Dam (청평댐)** — Complete gate control CFC program, HMI configuration, password modification records - **Goesan Dam (괴산댐)** — Gate control logic including Intake Gate #1, #2 and Tunnel Gate position control - Siemens PCS7 Solution Partner Certificate - KHNP Qualified Supplier certificates (JSC01, EPL01) - Technical specifications for water intake pump monitoring/control systems - Contracts and cost estimates for nuclear facility work ### Financial Data — Complete Banking Access Corporate bank accounts across 8 Korean banks with PINs and internet banking passwords: - 국민은행 (KB Kookmin) - 농협 (NH) - 부산은행 (Busan Bank) - 산업은행 (KDB) - 신한은행 (Shinhan) - 우리은행 (Woori) - 중소기업은행 (IBK) - 하나은행 (Hana) Includes corporate transfer PINs, certificate passwords, and payroll accounts. ### Government Portal Access Active credentials for Korean government and financial systems: - **HomeTax (국세청)** — National Tax Service - **UNIPASS (관세청)** — Customs Service - **KRX (한국거래소)** — Korea Exchange (Securities) - **KIBO (기술보증기금)** — Technology Guarantee Fund - **KSURE (무역보험공사)** — Trade Insurance - **NICE / KED** — Credit Rating agencies - **Statistics Korea** — Government statistics - Multiple banking portals ### SQL Server & ERP Databases Direct SA access to the ERP database server. Multiple databases containing complete business operations — financials, customer data, trade records, inventory management, material tracking, HR information, and quality control spanning years of operations. ### Digital Certificates & NPKI Keys Corporate PFX certificates for corporate signing, tax filing, and banking — including UKSEUNG Chemical corporate certificates, PANAX financial certificates, executive personal certificates, and BizBank approval certificates. **NPKI (National PKI) private keys** — used for legally binding digital signatures in Korean government and financial systems. ### Personal Identification Documents Executive identification documents including Chairman passport, CEO national ID card, and 15+ executives' passports, driver licenses, and national ID cards. **Korean national ID numbers (주민등록번호)** — permanent, non-replaceable national identifiers — exposed for multiple executives and employees. ### Employee & Supply Chain Data - Employee records — names, departments, personal bank accounts, national ID numbers - Vendor bank accounts — complete supply chain payment records - Domestic business partners with registration numbers and contacts - International trade partners across 12+ countries - Employee phone directory - Email archives from trade and procurement departments ### File Server Complete corporate file server contents spanning all departments — Finance, HR, Sales, R&D, Safety, Production. Includes financial records, trade correspondence, chemical formulation data, contracts, NDAs, insurance records, loan documents, safety department credentials, and chemical management system data. --- ## Impact Assessment | Category | Risk Level | |---|---| | SCADA/ICS Credentials | **NATIONAL SECURITY** | | Nuclear Dam Controls | **NATIONAL SECURITY** | | Korean SSN (주민번호) | **CRITICAL** | | Banking + Transfer PINs | **CRITICAL** | | Government Portal Access | **CRITICAL** | | AD Domain Dump | **CRITICAL** | | ERP Databases | **CRITICAL** | | Digital Certificates + NPKI Keys | **CRITICAL** | | Employee PII + Bank Accounts | **HIGH** | | Vendor Payment Records | **HIGH** | | Executive IDs (Passports, Licenses) | **HIGH** | | Corporate File Server | **HIGH** | ### Regulatory Exposure: - **PIPA (개인정보보호법)** — Korean Personal Information Protection Act - **K-ISMS (정보보호관리체계)** — Information Security Management System - **산업기술보호법** — Industrial Technology Protection Act - **전자금융거래법** — Electronic Financial Transactions Act - **원자력안전법** — Nuclear Safety Act --- ## Affected Third Parties The breach extends beyond PANAX GROUP to their industrial clients whose SCADA configurations, project files, and control system access are included in the exfiltrated data: - Samsung SDI - Hyundai Steel - Korea Hydro & Nuclear Power (KHNP) - EcoPro - LG Chem - POSCO / POSCO E&C / POSCO DX - Celltrion - Air Liquide - Korea Western Power - Narae Energy Service --- **The company has been contacted.** **Data publication will proceed if no agreement is reached.**