Actor Claims to Sell Root Access to South Korean Government Server

Summary

Threat actor zSenior is reportedly offering access to a South Korean government server, claiming root privileges, a path to 42 internal hosts, and PostgreSQL superuser access to a host said to contain PII.

Key points

The listing attributes the access claim to threat actor zSenior and identifies the target as a South Korean government server on a *.go.kr domain.
The actor claims root-level access and the ability to pivot to 42 internal hosts.
The actor claims PostgreSQL superuser access to internal host 192.168.0.147, which reportedly contains PII.
The listing says proof is available on request and offers access for sale with escrow; it describes the sale as access only.
The claims are not independently verified in the supplied article.

Article Details

Victim Organization: South Korean government (specific agency not disclosed)
Incident Type: Claimed unauthorized access and sale of root-level access to a government server, with claimed lateral movement to internal hosts
Data Types Exposed: Personally identifiable information (PII), reportedly present on an internal host
Operational Impact: The actor claims the ability to pivot to 42 internal hosts. No service disruption or other operational impact is reported.
Ransom Or Extortion: The actor is reportedly offering access for sale and accepting offers with proof and escrow. No ransom demand or extortion is reported.
Claim Status: claimed

Threat Actors

zSeniorThe article identifies zSenior as offering for sale claimed root-level access to a South Korean government server and claiming privilege escalation and the ability to pivot to 42 internal hosts. These claims are not independently confirmed in the supplied content.

Products

CentOSThe compromised server runs CentOS and has been online for 1,642 days, increasing exposure risk.PostgreSQLThe actor also reports PostgreSQL superuser access to an internal host (192.168.0.147) containing PII and potential RCE, and is accepting offers with proof and escrow.

Industries

GovernmentThreat actor zSenior is offering root-level access to a South Korean government server on a *.go.kr domain, claiming completed privilege escalation and straightforward pivoting to 42 internal hosts.