Kimsuky Hackers’ Playbook Uncovered in Exposed ‘Kim’ Data Dump

A rare breach attributed to a North Korean–affiliated actor named “Kim” by the leakers has unveiled unprecedented insight into Kimsuky (APT43) operations, in what has been dubbed the “Kim” dump. The 9 GB dataset includes active bash histories, phishing domains, OCR workflows, custom stagers and Linux rootkit evidence, revealing a hybrid campaign that leverages Chinese-language tooling and infrastructure to target South Korean and Taiwanese networks.

The leak highlights a credential-focused intrusion model aimed at government PKI systems, advanced AiTM phishing, and deep system persistence. Technical analysis describes NASM-based malware development, OCR-driven extraction of Korean PKI and VPN documents, AiTM phishing via TLS proxies, and a Linux rootkit with syscall hooking and encrypted backdoor capabilities.

Additional indicators show privileged account rotations logged as 변경완료 and targeted reconnaissance of Taiwanese government and academic IPs, suggesting an expanded regional mandate for espionage and supply-chain infiltration.