Kimsuky APT Data Leak – GPKI Certificates, Rootkits and Cobalt Strike Personal Uncovered

Kimsuky APT operator files leaked on a dark-web forum revealed Deepin VM images and a public VPS containing browser histories, auth logs, thousands of stolen GPKI certificates, a Java certificate-cracking tool, and bespoke malware — notably a Tomcat Kernel Rootkit that hooks network calls and a customized Cobalt Strike beacon using HTTP over port 8172. The artifacts provide direct insight into active spear-phishing campaigns against South Korean government entities and demonstrate advanced persistence and evasion techniques enabling credential theft, document signing impersonation, and stealthy C2 access.