Hackers who exposed North Korean government hacker explain why they did it

In a remarkable turn of events earlier this year, two hackers infiltrated a computer and soon discovered its alarming connection to a hacker allegedly affiliated with the North Korean government. Upon further investigation, they uncovered a trove of evidence linking this individual to various cyberespionage activities orchestrated by North Korea, along with hacking tools and the underlying infrastructure supporting these operations. Saber, one of the hackers, shared with TechCrunch that they had access to the North Korean government operative’s computer for about four months. However, upon realizing the gravity of the information they had unearthed, they felt compelled to leak it to the public. "These nation-state hackers operate for all the wrong reasons, and I hope we can expose more of them—they deserve it," Saber stated after he and his partner, cyb0rg, released a detailed account of their findings in the renowned hacking e-zine Phrack. Numerous cybersecurity experts and firms vigilantly monitor the activities of North Korean hackers, who are involved not only in espionage but also in extensive cryptocurrency heists and operations where they masquerade as remote IT workers to fund the regime's nuclear ambitions. However, Saber and cyb0rg took an unprecedented step by hacking the hackers themselves, offering fresh insights into how these government-sponsored groups operate on a day-to-day basis. Preferring to remain anonymous and go by their handles, Saber and cyb0rg expressed concerns about potential reprisals from the North Korean regime. Saber identified himself as a hacktivist, drawing inspiration from notable figures like Phineas Fisher, known for targeting spyware companies. Despite recognizing the illegality of their actions, they emphasized the importance of sharing their findings with the public. "Keeping it to ourselves wouldn’t have been beneficial," Saber explained. "By leaking this information, we hope to equip researchers with new tools for detection." Saber hopes their actions might expose current victims of North Korean hackers, potentially leading to a loss of access for these operatives. "Illegal or not, this has provided concrete evidence to the community, which is crucial," cyb0rg added through Saber. Interestingly, Saber expressed suspicions that the hacker, referred to as 'Kim', may not solely be tied to North Korea. Based on their findings, which suggested that Kim did not work during Chinese holidays, Saber speculated that he might actually be based in China and possibly serve both governments. Furthermore, he noted instances where Kim translated Korean documents into simplified Chinese using Google Translate. Saber refrained from any attempts to contact Kim, believing that dialogue would be futile. "He’s just supporting leaders who oppress his own people. I’d advise him to use his skills for good, but he's likely been conditioned by propaganda his entire life, making such advice meaningless," he remarked, highlighting the severe restrictions on information that North Koreans endure. When asked about their methods for accessing Kim's computer, Saber remained tight-lipped, suggesting they could replicate their success on other systems. During their operation, they also discovered active hacking campaigns against South Korean and Taiwanese firms, which they subsequently informed. Given the North Korean hackers' history of targeting cybersecurity professionals, Saber acknowledged the risks involved but stated, "I'm not overly worried. There’s not much to be done about it, but I’m definitely being more cautious."