According to Mars Finance news, Slow Mist's Chief Information Security Officer 23pds tweeted that "a member of the suspected North Korean hacker group Kimsuky APT has encountered a significant data leak, with hundreds of GB of internal files and tools leaked. The intrusion likely occurred in early June 2025, exposing the organization's complex backdoors, phishing frameworks, and reconnaissance operations. Analysis of the leaked files indicates that the internal dumps originated from two compromised systems belonging to a Kimsuky operator codenamed 'KIM'. One is a Linux development workstation running Deepin 20.9; the other is a publicly-facing VPS used for spear-phishing activities."