kim-cyka continued

EDIT: a trustable journalist has posted an update here: https://x.com/koryodynasty/status/1979048385937121406

it is alledged the perpetrators are Chinese-affiliated, and possibly responsible of a fire in a bunch of Korean datacenters too: https://www.news1.kr/local/moi/5927009

This is the second part of the investigation into KIMSUKI’s leak.

We had already explored this in our first post, but as a reminder:

This seem to be a Linux dev machine, mounted through hgfs
Approximately 20,000 records Brave / Chrome browser histories. These records reveal numerous email addresses accessed, websites visited, and tools downloaded.
A large number of passwords were found in the file mnt/hgfs/Desktop/fish_25327/vps20240103.docx. These passwords include email and VPS passwords:
- [email protected]:H4FHKMWMpX8bZ (https://sg24.vps.bz:4083)
- [email protected]:dr567h%a”G6*m (https://monovm.com)
- root:1qaz2wsx
- [email protected]:!QAZ4rfv!@#$

This server was used for various phishing campaigns (vps1735811325, hosted on vps.bz). The SSL certificates and auth.log on the server are noteworthy, and indicates attacks on several entities.

phishing attack of the South Korean Defense Counter-intelligence Command (dcc.mil.kr)

The Defense Counterintelligence Command (DCC) is the intelligence agency of the South Korean armed forces. The acronym DCC refers to the Defense Counterintelligence Command (Korean: 국군방첩사령부, Gukgun bangcheop saryeongbu), which is a military intelligence security agency of the Republic of Korea’s Ministry of National Defense (MND).

Its primary task is to advance military counterintelligence by collecting and analyzing intelligence globally. This includes:

Analysis and development of intelligence collection and counterintelligence systems.
Creating military security networks.
Clandestine and covert operations.
Countering hybrid threats and counterterrorism.
Defense (arms) industry security.
Executive protection and foreign military threat assessment.

Logs show that a phishing attack was launched just a few days before the leak against dcc.mil.kr. The same logs also contain entries for the South Korean Supreme Prosecutors’ Office (spo.go.kr), korea.kr, daum.net, kakao.com, and naver.com.

grep -Fhr 'dcc.mil.kr' log | uniq
[email protected]_amFuZHkzOTEyQGRjYy5taWwua3I=
[email protected]_ZGkwMzExMTFAZGNjLm1pbC5rcg==
[...]

the Korean Ministry of Foreign Affairs email platform

In a file named mofa.go.kr.7z, we found a copy of the South Korean Ministry of Foreign Affairs email platform. Based on the file’s last modification date, this source code may have been obtained very recently:

1923 Apr  1 07:15 .gitignore
  96 Apr  1 07:15 .gitmodules
 4096 Apr  1 07:15 kebi-batch/
 4096 Apr  1 07:15 kebi-core/
 4096 Apr  1 07:15 kebi-resources/
 4096 Apr  1 07:15 kebi-web-admin/
 4096 Apr  1 07:15 kebi-web-archive/
 4096 Apr  1 07:15 kebi-web-mail/
 4096 Apr  1 07:15 kebi-web-mobile/
 4096 Apr  1 07:16 kebi-web-parent/
 7528 Apr  1 07:16 pom.xml
14099 Apr  1 07:15 README.txt

We might look for vulnerabilities at a later date if I am not too busy. Shodan fingerprinting might also be useful :^)

access to the South Korean government’s internal network

It appears that our mysterious threat actor was able to access the Korean government’s internal network system. There is a project named onnara_auto, which contains some very interesting files.

For example, the file /onnara_auto/log/log-20250511.log, we can find reference to a mysterious hostname: onnara9.saas.gcloud.go.kr. That hostname is not accessible from the public internet, but is mentioned in some documents as some internal government portal.

other items

On June 13, 2025, the Threat-Actor registered webcloud-notice.com
there are some certificates and private keys for the Korea Telecom (KT) remote control service (rc.kt.co.kr) (???)
In the mnt/hgfs/Desktop/111/account/account.txt file, there are a large number of passwords from LG Uplus (LGU) in South Korea. The APPM_TRANS.txt and 111/config.txt files also contain credentials for LGU’s internal servers.
The following links were found in the Google Chrome profile.Is wwh1004 his GitHub account?

"https://accounts.google.com:443,https://[*.]0x1.gitlab.io":
"https://accounts.google.com:443,https://[*.]aldeid.com":
"https://accounts.google.com:443,https://[*.]asawicki.info":
"https://accounts.google.com:443,https://[*.]devglan.com":
"https://accounts.google.com:443,https://[*.]edureka.co":
"https://accounts.google.com:443,https://[*.]johnwu.cc":
"https://accounts.google.com:443,https://[*.]majorgeeks.com":
"https://accounts.google.com:443,https://[*.]maskray.me":
"https://accounts.google.com:443,https://[*.]namecheap.com":
"https://accounts.google.com:443,https://[*.]qwqdanchun.com":
"https://accounts.google.com:443,https://[*.]rakuya.com.tw":
"https://accounts.google.com:443,https://[*.]redteaming.top":
"https://accounts.google.com:443,https://[*.]reversecoding.net":
"https://accounts.google.com:443,https://[*.]shhoya.github.io":
"https://accounts.google.com:443,https://[*.]sparktoro.com":
"https://accounts.google.com:443,https://[*.]tutorialspoint.com":
"https://accounts.google.com:443,https://[*.]wiseindy.com":
"https://accounts.google.com:443,https://[*.]wwh1004.com":
"https://accounts.google.com:443,https://[*.]wwh1004.github.io":
"https://pay.google.com:443,https://[*.]purevpn.com":
"https://pay.google.com:443,https://[*.]purevpn.com.tw":
"https://pay.google.com:443,https://[*.]zoogvpn.com":

I’ve compiled a list of domains accessed by the TA, by URLs and by domains. It is accessible here.

KIM uses Google Translate to translate error messages into Chinese.
His Chrome browser history shows many Taiwanese government and military websites.
The certificates of South Korean citizens need a closer look, as does why he is particularly interested in university professors.
The work/home/user/.cache/vmware/drag_and_drop/ folder contains files KIM moved between his Windows and Linux machines. These files include Cobalt Strike loaders and reverse shells written in PowerShell. There are also compiled versions of the Onnara code and Onnara modules used for proxying into government networks.
The files voS9AyMZ.tar.gz and Black.x64.tar.gz need further examination. The hashes for these binaries are not yet on VirusTotal, but the filenames look enticing:
- e6be345a13641b56da2a935eecfa7bdbe725b44e payload_test.bin
- 3e8b9d045dba5d4a49f409f83271487b5e7d076f s.x64.bin
- 2bcef4444191c7a5943126338f8ba36404214202 payload.bin

sample analysis

generator for the defense counter-intelligence command

This phishing tool exposes an HTTPS website (the phishing site) with a domain similar to a victim’s familiar and trusted domain. Victims would then receive a link to this phishing website. This URI will always throws a login error.

The benefit of this “trick” is that the victim sees an error from https://dcc.mil.kr (a site they are familiar with and trust), even though their credentials have already been submitted to the phishing site. They might mistake it for some weird networking issue, reload the page from google, and retry.

Two files are interesting:

config.php: Contains a long blacklist of IPs (and other blacklists) so that companies like Trend Micro and Google cannot find the phishing site. This is so that Threat-Intel companies do not index the page as malicious.
generator.php: This is the admin interface for remotely managing the phishing attacks. It is accessible via a configurable password. However, the cookie is hardcoded and can be used to access the admin interface by setting the cookie instead of the password:

To scan the network for phishing results:

curl -v --cookie "HnoplYTfPX=x" https://phishing-site/logs.php

tomcat remote kernel backdoor

There is a kernel-level remote backdoor, working through an LKM. It allows an attacker to remotely access the host and hide themselves. The backdoor includes a client (tcat.c), a server-side LKM (vmwfxs.mod.c), and a user-mode backdoor (master.c).

The LKM communicates with its companion user-mode backdoor via /proc/acpi/pcicard, and is activate through a TCP stream.

The main password is "Miu2jACgXeDsxd", and the client uses "!@nf4@#fndskgadnsewngaldfkl".

char smtp_e1[]     = "250-example.comrn250-STARTTLSrn250 SMTPUTF8rn";
char smtp_tls1[]   = "220 Ready to start TLSrn";
char smtp_starttls[] = "starttlsrn";
char smtp_hello[]  = "HELO Alicern";

private cobalt strike beacon

There is also a custom Cobalt Strike C2 beacon. The source code was last updated in June 2024.

A config.cpp file, found in the Intellij cache, contains two Cobalt Strike configuration binary blobs. These are valid binary blobs that can be parsed using SentinelOne’s CobaltStrikeParser script, containing the following settings:

plaintext
BeaconType                       - HTTP
Port                             - 8172
MaxDNS                           - Not found
PublicKey_MD5                    - c5b6350189a4d960eee8f521b0a3061d
C2Server                         - 192.168.179.112,/dot.gif
UserAgent                        - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSSEM)
..
Watermark_Hash                   - BeudtKgqnlm0Ruvf+VYxuw==
Watermark                        - 126086

There is more research to be done. For instance, the TA seem to use Toybox a lot for development. Phishing logs must also be investigated. From the looks of it, the TA targeted Naver Maps and the Korea’s Ministry of Unification. But that’s all for another day, I’m tired.

See you next time :)~