“Million OK!!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure

Hunt researchers observed a cluster of IPs and recently registered domains returning a unique 'Million OK !!!!' HTTP response and using Naver branding, attributing the infrastructure to North Korean APT Kimsuky; the report catalogs IPs, resolving domains, Sectigo TLS certificates, certificate fingerprints, and a registrant email previously tied to KLogEXE/FPSpy, providing actionable IOCs and TTPs for monitoring and mitigation.