Slow Mist CISO: Suspected North Korean hacking group Kimsuky APT members suffered a data breach, exposing internal tools and operational details

23Pds, SlowMist's chief information security officer, tweeted: "A suspected member of Kimsuky APT, a North Korean hacking group, suffered a major data breach that exposed hundreds of gigabytes of internal documents and tools. The breach, which occurred around early June 2025, exposed the group's sophisticated backdoor, phishing framework and reconnaissance operations. According to an analysis of the leaked files, internal dumps originated from two compromised systems of Kimsuky operators under the alias'KIM '. One was a Linux development workstation running Deepin 20.9; the other was a public-facing VPS used for spear phishing campaigns."