Hackers breach North Korean spy hacker's PC, leak rare intel on secretive group

India Today

13-08-2025

A rare cyber incident has turned the tables on one of North Korea's most well-known hacking units. The group, called Kimsuky, is believed to be linked to the country's intelligence operations. But this time, its own systems were compromised by two hackers who say they wanted to expose the group's methods and motives.The attackers, using the names "Saber" and "cyb0rg," claim they oppose everything Kimsuky stands for. They accuse the group of carrying out hacks to serve the political and financial interests of the North Korean regime rather than treating hacking as a skill or challenge. In a strongly worded message shared through the hacker publication Phrack at the DEF CON 33 conference, the pair accused Kimsuky of enriching leaders, following orders blindly, and exploiting others.advertisementThe breach led to an 8.9GB data dump, now hosted on the Distributed Denial of Secrets (DDoSecrets) website. The files appear to contain both stolen data and the group's own hacking tools. Cybersecurity researchers believe the leak could reveal previously unknown campaigns, connect related attacks, and give a clearer view of how Kimsuky operates behind the scenes.
The leaked material includes phishing records showing attempts to break into multiple South Korean government domains. These include accounts under the Defence Counterintelligence Command (dcc.mil.kr) and other official sites like spo.go.kr, korea.kr, and well-known South Korean email providers daum.net, kakao.com, and naver.com. One of the most striking finds is a compressed archive containing the complete source code of the Ministry of Foreign Affairs' "Kebi" email platform, with components for webmail, administration, and data archiving.Other files point to a variety of hacking tools and resources. These range from live phishing kits and PHP scripts for creating fake websites to avoid detection, to Cobalt Strike loaders and proxy modules used to hide malicious activity. The dump also contains binary files not yet flagged in major malware databases, suggesting they may be new or customised tools.There are also personal traces — browser histories linking to suspicious GitHub profiles, records of VPN service purchases, and visits to hacking forums and even Taiwanese government sites. Logs from command-line sessions show connections to internal systems, while translation tools appear to have been used for reading Chinese error messages.While some of this information matches earlier reports about Kimsuky, security analysts say this leak ties together multiple strands, potentially exposing parts of the group's infrastructure that were previously hidden. Experts caution, however, that such a setback may cause only temporary disruption to Kimsuky's operations.- Ends