1. Who got hacked?
Two hackers known as Saber and cyb0rg say they compromised the computer of a North Korean government hacker linked to the Kimsuky espionage group.
2. What is Kimsuky?
Kimsuky, also known as APT43 and Thallium, is an advanced persistent threat group believed to be part of North Korea’s intelligence operations. It is known for targeting journalists, government agencies, and foreign organizations.
3. What did the hackers find?
The breach yielded almost 9 GB of data, including phishing logs, hacking tools, internal manuals, stolen credentials, and source code.
4. Which targets were affected?
The data included logs of phishing campaigns against South Korea’s Defense Counterintelligence Command and major online platforms such as Kakao, Naver, and Daum.
5. Any sensitive government data?
Yes. The leak exposed the full source code of South Korea’s “Kebi” email platform used by its Ministry of Foreign Affairs, along with admin and archive modules.
6. What tools were in the leak?
The files contained phishing-site toolkits, Cobalt Strike loaders, reverse shells, proxy modules, and other malicious binaries used for cyber-espionage.
7. How was the hacker identified?
Saber and cyb0rg said they matched artifacts, file configurations, and domains to known Kimsuky infrastructure, confirming the operator’s identity.
8. Any clues about work habits?
They noted the hacker kept strict office hours, logging on at 9 a.m. and off at 5 p.m. Pyongyang time.
9. Why is this significant?
This is a rare instance where an individual member of a North Korean APT group was compromised, offering a direct view into its operations instead of relying on second-hand evidence.
10. Could this disrupt Kimsuky?
Cybersecurity experts believe the leak could temporarily hamper the group’s activities while giving researchers valuable insight into its methods and partnerships, including possible collaboration with Chinese hackers.
Leave a Reply