Kimsuky leak in Phrack exposes a credential theft playbook

DomainTools analyzed the “Kim” leak that exposed North Korea’s Kimsuky/APT43 credential theft playbook targeting South Korea and Taiwan. The data first surfaced in Saber and cyb0rg’s “APT Down: The North Korea Files” in Phrack #72, dumped from the operator’s workstation and VPS around June 10, 2025. The dump revealed terminal histories showing malware compilation with NASM, stolen government PKI certificates, phishing infrastructure mimicking official portals, and a Linux rootkit, all pointing to a credential-first espionage strategy. Turns out they were also using OCR tools to extract juicy details from Korean security PDFs, because why hack when you can just read the manual? Intel 471 is less sure who “Kim” works for: Simplified Chinese searches, heavy Baidu use and Chinese holidays such as the Dragon Boat Festival put roughly even odds on an operator based in China who keeps North Korean office hours.