Two hackers, known as Saber and cyb0rg, say they infiltrated a virtual workstation and a VPS used by an advanced persistent threat group referred to as \u201cKIM.\u201d The data, disclosed at DEF CON through the latest issue of Phrack, includes almost 20,000 browser history entries, detailed backdoor operation guides, login credentials, and logs from phishing campaigns targeting South Korean government organizations, as reported by Dark Reading<\/a>.<\/p>\n\n\n\n The leak also revealed an arsenal of offensive tools such as the TomCat kernel backdoor, Ivanti RootRot exploit, customized Cobalt Strike beacons, and Android Toybox malware variants. Security experts have verified the authenticity of much of the material, underscoring its potential intelligence value.<\/p>\n\n\n\n While some phishing kits and domain patterns mirror those linked to North Korea\u2019s Kimsuky group, linguistic cues, browsing patterns, and forum activity suggest the operator may be Chinese. Indicators include reconnaissance activity against Taiwan and participation in Chinese-language hacking forums.<\/p>\n\n\n\n The release of these internal assets provides cybersecurity professionals with rare, direct insight into the operational workflow of a state-aligned threat actor. Beyond revealing specific tools, the data gives context on targeting patterns, infrastructure choices, and day-to-day management of attacks\u2014information that can be leveraged to improve detection and incident response across sectors likely to be targeted.<\/p>\n\n\n\n Learn how AI Agents can supercharge your company\u2019s profits and productivity at TMC\u2019s <\/a>AI Agent Event <\/a>in Sept 29-30, 2025 in DC.<\/em><\/strong><\/p>\n\n\n Rich Tehrani serves as CEO of TMC<\/a> and chairman of ITEXPO<\/a> #TECHSUPERSHOW Feb 10-12, 2026 and is CEO of RT Advisors<\/a> and is a Registered Representative (investment banker) with and offering securities through Four Points Capital Partners LLC <\/a>(Four Points) (Member FINRA\/SIPC). He handles capital\/debt raises as well as M&A. RT Advisors is not owned by Four Points.<\/em><\/p>\n\n\n\n The above is not an endorsement or recommendation to buy\/sell any security or sector mentioned. No companies mentioned above are current or past clients of RT Advisors.<\/p>\n\n\n\n The views and opinions expressed above are those of the participants. While believed to be reliable, the information has not been independently verified for accuracy. Any broad, general statements made herein are provided for context only and should not be construed as exhaustive or universally applicable.<\/p>\n\n\n\n Portions of this article may have been developed with the assistance of artificial intelligence, which may have contributed to ideation, content generation, factual review, or editing<\/em>.<\/p>\n","protected":false},"excerpt":{"rendered":" Key Takeaways: Two hackers, known as Saber and cyb0rg, say they infiltrated a virtual workstation and a VPS used by an advanced persistent threat group referred to as \u201cKIM.\u201d The data, disclosed at DEF CON through the latest issue of Phrack, includes almost 20,000 browser history entries, detailed backdoor operation guides, login credentials, and logs<\/p>\n","protected":false},"author":44,"featured_media":24653,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[156],"tags":[],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts\/24652"}],"collection":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/comments?post=24652"}],"version-history":[{"count":2,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts\/24652\/revisions"}],"predecessor-version":[{"id":24677,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts\/24652\/revisions\/24677"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/media\/24653"}],"wp:attachment":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/media?parent=24652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/categories?post=24652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/tags?post=24652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-content\/uploads\/2025\/07\/AiAgent-500x600-Speaker-logos-v3.jpg\")
<\/a><\/figure><\/div>\n\n\n