Researchers Track Suspected Kimsuky Infrastructure Using “Million OK!!!!” Response and Naver Branding
Summary
Hunt researchers linked newly observed domains and servers returning “Million OK!!!!” and displaying Naver branding to suspected Kimsuky infrastructure, identifying recurring domains, certificates, hosting, and server traits.
Key points
- Recently registered domains and IPs returned the distinctive “Million OK!!!!” HTTP response, a marker researchers say may help identify active servers.
- Some pages used Naver’s favicon; one domain appeared designed to mimic a Naver sign-in page.
- Observed infrastructure reused domains under TLDs including p-e.kr, o-r.kr, and n-e.kr, previously associated with Kimsuky activity.
- The observed IPs were hosted on the UCLOUD Information Technology ASN; several used Sectigo-issued TLS certificates.
- Many servers shared an outdated Apache, OpenSSL, and PHP stack.
- A separate server returning “Hello” shared infrastructure patterns and a certificate domain associated with an email previously linked by Unit 42 to KLogEXE and FPSpy domains.
Article Details
- Attack Vectors
- Naver-themed phishing pages use Naver branding and counterfeit sign-in pages to steal credentials; the article describes this as a recurring Kimsuky targeting pattern.
- Observed infrastructure returned the distinctive HTTP response “Million OK!!!!”; the article says it may be used as a marker to verify active servers, but its purpose is unclear.
- Defensive Notes
- Monitor for the distinctive “Million OK!!!!” HTTP response, associated domains and IP addresses, Naver-themed pages, and the listed certificate fingerprints.
- The observed infrastructure commonly used Apache/2.4.25 (Win32), OpenSSL/1.0.2j, and PHP/5.6.30; the article reports these as outdated server software.
- HuntSQL Explorer was used to search scan results for the distinctive HTTP response.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ozszg[.]top | Historical domain resolving to an observed suspicious infrastructure IP. |
cfa4a551515dc742s@gmail[.]com | Registrant email found for edoc-send.n-e[.]kr; Unit 42 reportedly linked it to two domains used by malware families. | |
| HOSTNAME | edoc-send[.]n-e[.]kr | Certificate common name associated with the observed server and described as connected to phishing and C2 infrastructure patterns. |
| HOSTNAME | mail[.]ozszg[.]top | Historical hostname resolving to an observed suspicious infrastructure IP. |
| HOSTNAME | nidauth[.]r-e[.]kr | Observed domain presenting the Million OK response and Naver favicon; described as likely mimicking Naver sign-in. |
| HOSTNAME | nld[.]blog-view[.]o-r[.]kr | Historical hostname resolving to an observed suspicious infrastructure IP. |
| IPV4 | 101[.]36[.]114[.]153 | Observed server displaying a Naver favicon and a Hello response, linked by the article to the identified infrastructure patterns. |
| IPV4 | 118[.]193[.]68[.]146 | Observed suspicious infrastructure returning the Million OK response. |
| IPV4 | 118[.]193[.]69[.]248 | Historical IP associated with suspicious infrastructure and the listed domains. |
| IPV4 | 118[.]194[.]248[.]148 | Observed suspicious infrastructure returning the Million OK response. |
| IPV4 | 123[.]58[.]200[.]13 | Historical IP associated with the reported infrastructure. |
| IPV4 | 123[.]58[.]200[.]50 | Observed suspicious infrastructure returning the Million OK response. |
| IPV4 | 152[.]32[.]138[.]191 | Observed suspicious infrastructure returning the Million OK response. |
| IPV4 | 152[.]32[.]138[.]63 | Historical IP associated with the reported infrastructure. |
| IPV4 | 152[.]32[.]243[.]153 | Observed suspicious infrastructure returning the Million OK response. |
| IPV4 | 152[.]32[.]243[.]184 | Historical IP associated with the suspicious hostname listed in the article. |
| SHA256 | 393cbd41f14b1c55bde92a32e10b5d65384e33a97c77f352bd90fdb8fd5d73ae | Certificate hash listed for *.nidcheck.o-r[.]kr. |
| SHA256 | 5f2c65e695d85395634e7ab561242425e6ef281ce2e14a0d5c1704ed593cfa5f | Certificate hash listed for *.againcheck[.]site. |
| SHA256 | 974e386f8facff325ec2f3ebb7439a9a1e4e4c88944d5beb5c341923dc993556 | Certificate hash listed for *.checkagain[.]store. |
| SHA256 | 98c85ef91e05593cd470ffe8698aa6d97b36e8b885200be87080b8c2a135fb9c | Certificate hash listed for *.checkmail.kro[.]kr. |
| SHA256 | d8a8ddda6cc12c5533268b20e48e1b636ce9173e9f9b5bb4c832fe00f1b26841 | Certificate hash listed for *.nidcorp[.]store. |
Threat Actors
Malware
Vendors
Products
Apache Web ServerLegacy Web Server Stack: The server administrator installed outdated software versions of Apache Web Server (Win32), OpenSSL, and PHP.Naverinvolving recently registered domains returning the same response. These web pages use the favicon of Naver, a South Korean technology corporation, although they have no association with the company. DomainOpenSSLLegacy Web Server Stack: The server administrator installed outdated software versions of Apache Web Server (Win32), OpenSSL, and PHP.PHPLegacy Web Server Stack: The server administrator installed outdated software versions of Apache Web Server (Win32), OpenSSL, and PHP.