Two hackers reportedly breached the computer of a North Korean hacker, identified only as “Kim,” and discovered stolen data from prominent South Korean organizations and companies. On Aug. 13, these white-hat hackers, under the aliases “Saber” and “cyb0rg,” had compromised Kim’s workstation, which contained a virtual machine and a virtual private sector that reportedly belonged to the North Korean hacking organization Kimsuky.
After gathering data, Saber and cyb0rg released a nine GB data dump on the cybersecurity e-zine “Phrack” in an article called “APT Down: The North Korea Files.” In the article, they accused Kimsuky of being driven by their own financial greed and political agenda, declaring that this article was an invitation for future hackers to target the group.
“It is a bit of a house of cards, because I think a lot of the perception about technology is based upon the false assumption that most people are safe from hacking attempts, especially state-sponsored hacking attempts,” Nathan Warkentin, Coding Club adviser, said. “Part of the issue is that organizations, made up of humans, are inherently fallible to social engineering, and there is no amount of data or security that can stop that.”
Among the information revealed in the data dump were passwords, Kimsuky tactics and techniques, and even a log of a Google search history. After finding records of malicious Korean files being machine-translated into Chinese, Saber and cyb0rg suspected that Kim may be a Chinese hacker. Additionally, despite Kim’s IP address being located in China and following the Chinese public holiday schedule, his Chrome settings were on Korea Standard Time, raising the theory that North Korean hackers and Chinese hackers are working together to target South Korea. However, Saber and cyb0rg stop short of implicating the Chinese government.
“The news that North Korea is working with Chinese hackers is alarming news,” Jasmine Ahn (10), vice president of Global Issues Network (GIN), said. “It points to the reality that threats can come not only from a country but sometimes from alliances. This could further complicate an already complicated global relationship, especially between South Korea, the US, China, and North Korea. As the vice president of GIN, I would like to think our club could help contribute toward awareness of cybersecurity.”
Kimsuky had previously infiltrated several South Korean government organizations, including South Korean embassies, the military intelligence security agency, and the Ministry of Foreign Affairs. Kimsuky seemed to work under the guise of interview requests, English-speaking think tanks, NGOs, and North Korea experts to gain confidential information from South Korea. While their main goals are espionage and data theft, they have led cryptocurrency heists to gain funds for North Korea’s nuclear weapons program.
“Cybersecurity will definitely influence global relationships,” Nam Hyo-young, AP World History teacher, said. “Even nowadays, there are conflicts—yes, physical wars, but also competitions to get more information at a faster speed than other countries. People are already using this information to target certain speakers or different places. I think we tend to neglect this side because we may not be affected by these conflicts in our daily lives, but we do have to be aware and see the bigger picture.”
Saber and cyb0rg accused Kimsuky of abusing their power in this recent era of the information race, calling them “morally perverted.” According to them, hacking is an art that is driven purely by creativity and should not be exploited to take from others and achieve a monetary incentive. As hacking becomes a more prevalent weapon between countries, the protection of cybersecurity is becoming a larger global issue.