Reported Kim Suki Insider Leak Includes Tools, Phishing Sites and Credentials
· 5:32 · Watch on YouTube ↗
Summary
The hosts discuss a reported 9 GB leak attributed to a supposed North Korean operation, including backdoors, phishing sites, a private Cobalt Strike beacon and access credentials. The leak’s authenticity and the operator’s attribution remain uncertain.
Key points
- The video cites FRACK Magazine and reports that authors Saber and Cyborg released a 9 GB data dump about a supposed North Korean hack.
- The dump reportedly contains sophisticated backdoors, phishing frameworks, reconnaissance material, a custom Tomcat kernel-level backdoor, a private Cobalt Strike beacon and an Android Toybox fork.
- Reported spear-phishing websites targeted South Korea’s Defense Counter Intelligence Command and Ministry of Foreign Affairs.
- The leak reportedly includes a hardcoded admin cookie that could enable unauthorized access to dashboards and phishing-tracking logs, as well as passwords that may still be valid.
- A speaker says the alleged operator could be a Chinese person working for North Korea; the video also cautions that the leak’s significance depends on its authenticity.
- The hosts warn that intruding into another country’s systems could disrupt cyber operations and provoke a response.
Article Details
- Topics
- [00:37] Reported insider leak associated with Kim Suki, AP43 or thallium
- [01:28] Reported contents of the leaked data, including backdoors and a private Cobalt Strike beacon
- [02:08] Reported 9 GB data dump and its uncertain North Korean attribution
- [02:30] Spear-phishing websites reportedly targeting South Korean government agencies
- [02:38] Hardcoded admin cookie, dashboard access and exposed passwords
- [03:11] Uncertain claim that the alleged operator may be Chinese and working for North Korea
- [04:10] Risks of disrupting another country’s cyber operations
Threat Actors
AP43Presented in the video as an alternate name for the hacker associated with the reported leak; the video notes that naming varies by source and the attribution is uncertain.Kim SukiThe video associates a hacker identified as Kim Suki with the reported insider breach and leak, but describes the underlying incident as a supposed North Korean hack and cautions that the material’s authenticity is uncertain.KimsukyPresented in the video as another name used for the hacker associated with the reported leak; the video notes that naming varies by source and the attribution is uncertain.