“Million OK!!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io finds an exposed Naver phishing server—change/cookie/login panels and 200+ hosted domains—plus a separate cluster spoofing Apple domains with distinctive TLS certificates.

Hunt tracked a likely North Korean campaign stealing Google and Naver credentials via iframes after its Binance spoof was flagged; an open directory also held Xeno-RAT and KakaoTalk logs.

A Hunt.io–Acronis investigation maps DPRK infrastructure: unlinked Lazarus and Kimsuky clusters, credential-theft toolkits in open directories, FRP tunneling nodes, and a 3CX supply-chain link.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.