APT Down and the mystery of the burning data centers
In August 2025 Phrack published the dump of an APT member's workstation. The attacker was most likely Chinese, working on targets aligned with North Korea's doctrine. The dump was full of exploits, attacker tools and loot. Data from government networks, cell carriers and telcos, including server databases and loads or private keys stemming from the government PKI. The attacker had maintained a steady foothold in various targets in South Korea and Taiwan before accidentally "losing" their workstation.
The dump sparked a government investigation, and big corporations like LG, Lotte and Korea Telecom were asked to explain themselves. The government also mandated an on-site audit in the data center where the hacks had taken place. On the day of the audit, some li-ion batteries in the data center mysteriously caught fire. The blaze destroyed close to 100 servers (which had no backup) and plunged public service in South Korea into disarray. Shortly after, the Lotte data center burned as well - the corporation had been victim of a breach recently, albeit by a different threat actor. In the beginning of October, one of the officers examining the government data center fire tragically died by his own hand.
The talk aims to revisit this mysterious sequence of events that was started by an article in Phrack #72. It doesn't hope to give answers or a solution, but narrates a story that could be from a spy thriller. Caution: Conspiracies and technical gore could be present.
Speakers of this event
Christopher Kunz
- APT Down and the mystery of the burning data centers
Sylvester
Sylvester is an editor and author for the German computer magazine c’t and its sister publication heise online. He writes mostly about Linux and open source, IT security, and topics adjacent to programming and software engineering. He also co-hosts a podcast on IT security.
- APT Down and the mystery of the burning data centers