|
|
|
|
August 21, 2025
|
Hackers Infiltrate Alleged North Korean Operative’s Computer, Leak Evidence of...
|
|
August 21, 2025
|
Ecosia Proposes Unusual Stewardship Model for Google Chrome
|
|
August 21, 2025
|
OpenAI Presses Meta for Evidence on Musk’s $97 Billion Takeover Bid
|
|
August 15, 2025
|
ChatGPT Mobile App Surpasses $2 Billion in Consumer Spending, Dominating Rivals
|
|
|
Hackers Breach North Korean Operative’s Computer, Leak Data Online
August 12, 2025
Two independent hackers, known as Saber and cyb0rg, claim to have infiltrated the computer of a North Korean government hacker, leaking its contents in what may be one of the most revealing looks yet into Pyongyang’s cyber operations.
The pair published details of the breach in the latest issue of Phrack magazine, a long-running cybersecurity e-zine, which was released during the Def Con hackers conference in Las Vegas last week.
According to their report, the hackers gained access to a workstation containing a virtual machine and virtual private server belonging to a man they call “Kim,” allegedly a member of Kimsuky — also known as APT43 and Thallium — a North Korean state-backed espionage group. The stolen data has been passed to Distributed Denial of Secrets (DDoSecrets), a nonprofit organization that archives leaked information for public access.
Kimsuky is known for targeting journalists, government agencies, and other strategic organizations, often engaging in cryptocurrency theft and laundering to fund North Korea’s nuclear weapons program. What makes this case unusual is that Saber and cyb0rg claim to have compromised an individual Kimsuky operative directly, rather than relying on the aftermath of a third-party breach.
Their findings suggest Kimsuky works closely with Chinese state-affiliated hackers, sharing tools and techniques. The leaked materials reportedly include evidence of successful intrusions into South Korean government networks, hacking tools, internal manuals, email addresses, passwords, and other sensitive data.
The hackers also detailed clues that led them to identify Kim as a North Korean government hacker, including file configurations, domains previously linked to Kimsuky, and consistent “office hours” from 9 a.m. to 5 p.m. Pyongyang time.
In their publication, Saber and cyb0rg condemned the group’s motives, writing:
“Kimsuky, you’re not a hacker. You are driven by financial greed, to enrich your leaders, and to fulfill their political agenda. You hack for all the wrong reasons.”
Emails sent to the addresses allegedly tied to Kimsuky members went unanswered.
|
|
|
Sign Up to
Our Newsletter!
Get the latest news in tech.
|
|
|
