APT Down and the mystery of the burning data centers (39c3)

In August 2025 Phrack published the dump of an APT member's workstation. It was full of exploits and loot from government networks, cell carriers and telcos. The dump sparked a government investigation, and corpos like LG and Korea Telecom were asked to explain themselves. Hours before an onsite audit, the data center mysteriously caught fire, destroying almost a hundred servers. Then another data center burned - and unfortunately, there was even one death. The talk aims to revisit this mysterious sequence of tragic incidents. [TW: Suicide, self-harm] In August 2025 Phrack published the dump of an APT member's workstation. The attacker was most likely Chinese, working on targets aligned with North Korea's doctrine. The dump was full of exploits, attacker tools and loot. Data from government networks, cell carriers and telcos, including server databases and loads or private keys stemming from the government PKI. The attacker had maintained a steady foothold in various targets in South Korea and Taiwan before accidentally "losing" their workstation. The dump sparked a government investigation, and big corporations like LG, Lotte and Korea Telecom were asked to explain themselves. The government also mandated an on-site audit in the data center where the hacks had taken place. On the day of the audit, some li-ion batteries in the data center mysteriously caught fire. The blaze destroyed close to 100 servers (which had no backup) and plunged public service in South Korea into disarray. Shortly after, the Lotte data center burned as well - the corporation had been victim of a breach recently, albeit by a different threat actor. In the beginning of October, one of the officers examining the government data center fire tragically died by his own hand. The talk aims to revisit this mysterious sequence of events that was started by an article in Phrack [#72](https://events.ccc.de/congress/2025/hub/tag/72). It doesn't hope to give answers or a solution, but narrates a story that could be from a spy thriller. Caution: Conspiracies and technical gore could be present. [TW: Suicide, self-harm] Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2025/hub/event/detail/apt-down-and-the-mystery-of-the-burning-data-centers