Sylvester Tremmel - [EN] APT Down and the mystery of the burning data centers
Presenters detail vulnerability discovery and exploitation in Sylvester Tremmel - [EN] APT Down and the mystery of the burning data centers.
Summary
Journalists on the APT Down Dump
Sylvester Tremmel and colleague Christopher Kunz summarize c't reporting on a leaked workstation belonging to threat actor Kim, likely linked to North Korea's Kimsuky APT, while urging researchers to explore the dump themselves.
What the Dump Contains
Researchers shoulder-surfed Kim using Deepin Linux VMs, capturing messy desktops with Cobalt Strike beacons, Ivanti webshells, rootkits, phishing results against South Korean targets, and a previously unknown Linux rootkit.
Attribution Clues
Kim may be a Chinese national working North Korean hours, using Chinese fonts and struggling with Korean OCR. Tremmel stresses Kim is a cybercriminal, not a hobby hacker.
Burning Data Centers Mystery
The talk title references follow-on reporting about destructive attacks on data centers tied to the broader APT Down investigation, with Korean translation and document-format challenges complicating analysis.
Related talks
PROIDEA Events·45 min
Ireneusz Tarnowski
Presenters detail vulnerability discovery and exploitation in Ireneusz Tarnowski: Phishing? - nie dziękuję. Jak zmienił się krajobraz technik i taktyk grup APT.
PROIDEA Events·41 min
Industry experts analyze emerging threats surrounding Łukasz Lamparski: Jak grupy APT wykorzystują urządzenia brzegowe do operacji szpiegowskich | OMH.
PROIDEA Events·48 min
Chi En (Ashley) Shen
Chi En (Ashley) Shen explores CONFidence 2019: "Into the Fog - The Return of ICEFOG APT".