At a Glance Actor or Group Kimsuky (suspected North Korean state-sponsored group, also tracked as TA406 and APT43) Activity Type Spear-phishing, living-off-the-land AnyDesk staging, GitHub Pages hosting, and credential harvesting Targets or Victims Ukrainian diplomatic and defense specialists, South Korean citizens, and German commercial targets Scale

Kimsuky is using GitHub and other trusted code platforms to deliver malware, run commands, and steal data from Ukrainian experts in diplomacy, security, and international policy. The North Korea-linked group’s Operation GitPower combines targeted emails, fake PDF files, and Windows scripts to turn routine work requests into possible entry points for cyber spying. The attacks use conference invitations and research requests to build trust before sending harmful files. Codeberg hosts malicious archives, GitLab supplies decoy documents and scripts, and GitHub supports payload delivery and data transfers. Most observed attempts against the Ukrainian targets were unsuccessful, an important limit on the campaign’s reported impact. Researchers from Genians identified the activity in an October 12, 2026 report, linking it to earlier Operation GitPower attacks through shared code, file names, scheduled tasks, and methods used to upload stolen information. Their findings show how the group changes its email themes while keeping much of its attack framework. Kimsuky Operation GitPower One attack began on August 6 with a fake speaking invitation to the Korea Cyber Security Conference. The email used real event details, praised the recipient’s work, and offered travel support and payment. Unlike earlier Kimsuky GitHub attacks that delivered malicious shortcuts, this case started with a message containing no harmful link or attachment. Only after a target replied did the attacker send a ZIP archive with invitation materials. A later version used password protection, which researchers assessed as an effort to make inspection harder for email security tools. Inside, a genuine-looking HTML invitation helped hide a Windows shortcut dressed up as a PDF. A separate approach on August 19 impersonated a policy researcher seeking feedback on a report about Russia and North Korea. Spear Phishing Targeting Ukrainian Government Agencies (Source – Genians) After receiving a reply, the attacker sent a Codeberg download link. When the malware attempt failed, a September follow-up switched to a fake meeting login page designed to steal account details. Opening the malicious shortcut starts cmd.exe and uses curl to download files from GitLab. Depending on the version, a decoy PDF opens while another download is saved as a VBE script and runs in the background. The initial script retrieves a follow-up component that executes in memory. The loader hides PowerShell commands by inserting extra words, then removes them with Replace() just before execution. The follow-up script creates a task that looks like a Google update and runs every 15 minutes. It collects systeminfo output and a listing of the user’s Downloads folder, rather than automatically stealing every file there. GitHub Malware Delivery and Data Theft Collected information is encoded in Base64 and uploaded through the GitHub Contents API using a hardcoded access token. Temporary files and the initial script are then deleted. Similar use of GitHub and recurring tasks appeared in Kimsuky AI phishing campaigns covered previously, although those earlier findings included AsyncRAT payloads not established for this Ukrainian attack chain. Other September samples used peace-report and researcher résumé themes. Their shortcuts downloaded files named LICENSE and okay.md from GitHub, but these contained VBScript and PowerShell code. A OneDrive-themed task ran every minute, allowing a separate control server to deliver more scripts and receive files created during their execution. Archive Containing Malicious LNK Files (Source – Genians) The group also placed an unsigned, 64-bit fake Zoom installer in a public GitHub repository. It drops hidden scripts, creates a task that runs every minute, and contacts the same control server used by the September shortcut samples. It then downloads and starts the real Zoom installer, giving users a familiar installation screen after malware is already present. The wider operation has also featured Kimsuky OpenCode phishing decoys in earlier research, showing how lure production can change without replacing the core script-based approach. Genians linked the Ukrainian activity to Kimsuky through combined technical evidence, not simply the use of GitHub or the subject of an email. Genians assesses that the targeting may support spying on the war and ongoing cooperation between South Korea and Ukraine. Japanese decoy documents found in related repositories also suggest possible interest in Japanese speakers, but do not confirm successful attacks. The report does not establish that every file stored in those repositories reached an intended victim. For defenders, the report recommends linking endpoint events rather than blocking every development platform. A shortcut launching cmd.exe, curl, or hidden PowerShell should be reviewed alongside new scripts, update-themed tasks, GitHub API uploads, and unusual network connections. Installer checks should include digital signatures and background activity, since a real setup screen does not prove that the file launching it is safe. Indicators of compromise (IoCs):- File Hashes All hashes in this table are MD5 values published in the source’s IoC section. Type Published indicators MD5 05cec01db363488e6762097095d7b7fc 05e65662d55327febf5d4aaeca54f982 0919c2a84a1c76d6f5268dd5ffd7b5e7 0933fda33f46d2b31e023bf322a11d41 0a0fe8a557eff10b3b32528347b9d988 MD5 0ae92755dafc510efdc9f68e817b683a 0c89cc9118b863488f5ba240bfe396f6 14c8b93304700e27b479596024ef19cf 1f5416894b604ed6ef1f839414865eee 1f873bc5c6d5ff0ae0f228dbf26220ba MD5 1f8ad760e1feee7cecfe1bfadde93d4e 2062dde8114d57b0108e92371e29b3ed 2364f22dfe4d2018619cfba2b510f290 24b12630d402e4ce40d05e0623e56933 26642b9800192440621a70383595dea2 MD5 28210832c13d806e87cb8f1449cf8c5f 28fb9e179c3aac449b7e4d760f6b8b7d 2a100b8de6099b06449e3084b689c32d 2e36880877f32eac56ae4502ad057b2e 2f407d8e3dee54e0c4f776e5db55ae86 MD5 324352a61a343969a93386466d232684 337edcca9ef27cfe1a76f4cffa676026 33cd80a0b3059c23eadcf263ddbb330f 348150ce9f3c49283c16d9b37e6dc354 353311ea9b82724aa862477cae44cd39 MD5 380d5a157077b7c8bdfe7c6d9628fe6d 382bb72f7f42f27b04d1fedd6d633a82 3d3f6897f57f4a7b94f83278e795dc18 40b48810400a825858946aae9ff5b50d 4f5694f61b4c244cc2269c3a5eb8a7c7 MD5 5282b7aa97f45feeff73ba87d0523e53 567a2aedd00fa97f03fc852b1d949596 57025a7f9d9d2ef4930dec189bdd0bd0 5a0923427b2fcb5070510753e4f0c0d0 5dd387acef74a14a63dbc883aadee854 MD5 5fa367e38148de7e19abe789451a7a38 620bc65bb86962f633a37586e17da9f3 6896f9c3f24f2fdc7966f753ad3ce723 76ed1e64d1c9ea3e4b91f7ed7b2f59f2 77b9a8309e9f80ca442c629396cc3f6e MD5 78bf053eea23b86e42a658245d8de904 7a6e1e578342864c1bb07c83b4e677e3 7e76b71247c995359a7642fe62f3b28f 7f1b4583fec9db44e85b458df4e55669 8445ffdacfed1fc9951e62ea054ee1c3 MD5 85fcd85d24e1b391cbf0c22b0c8a362a 896a859812f181286542a0041a549156 8d73beff15a0467b9bc2b74f6abed75d 90449413823f31c89f2bd12b5a1ae5d5 93587de64c445e7fe20351f24c4a97d4 MD5 9b33a10f7637c7ce9e5e8aa1ed7303dd 9c2d0cace5c703afa9f3862d19073c6d 9d3b0832e1759d29d2651f3a2d34d781 9f14d0c51795489bbb8d1853fb7e269d a0f8c686d57c746bcd97e21dc8fa2159 MD5 a49a2676174f1d7c5e8647e4fc7316de a80dd39ce35e712fde43b51f6a5ac22a a86861abef9de0148a560614a5830a19 ae2a710e1940b5a7c3d8c7da754a4bdc ae2fb368e8f33de4b5382dc3296c7076 MD5 b52d4d43ddbd8a2b34808e45bd1d4504 b64e08e12d90ee33c4409204a1ea509b b65049b275769947fce9d332de39ad58 b7db9fe60ce4a2372ee7d4665ae859ba bc903979c2ef367f15424d651eb1730d MD5 bf95687e8f040d9b656e2702eca30ff6 bfb0591fb5c58b5ef751c9994cb86fbd c6017291b89dc20b4b333b6e5d1e92c2 ca3e297df21d63fabbcac343dd2740c9 d915752f0dfe5d2ca3388cc711840d31 MD5 d9ebfcce15a1a2c39c22aea092d6fb11 da44fa987f5a1967b8691254419d8e52 dc5a698e0f74b79da77592145a669f51 dcbb6683e1f5c826d0f65dc68999fe52 e5b1e7b3f3ab24239f2cd1cbce806228 MD5 ea02654da967a66ba0bda85f8578562a eb9d0c1e252a2b08ddfdeb7dc458032a ed02d851d07f38d9bb04a0d2e464cf10 f547cad15814b06c7876c63609da5b8f f549fc826acf79521d6a0c8aa63095e0 MD5 f5f5da0dac34841451c5328871d0d77b f6786ff62fdfdc46cfb84ff7cc2a580a f6f00417b925bf42090a89f8668fb554 f85016e8cc6b509a9fba1ccd1dc88da1 fa87911771a52e3c1ffb1c39da59540c Network Indicators The IP addresses below appear under “C2” in the source. The domains belong to the report’s broader set of related attacks and should not all be treated as confirmed command servers for the same infection chain. Type Published indicators C2 IP addresses 45.150.109[.]102 85.155.224[.]59 103.153.65[.]67 111.92.246[.]145 169.197.85[.]174 195.250.24[.]113 Domains argeninese.dothome.co[.]kr argentinese.medianewsonline[.]com bbcnews04.dothome.co[.]kr bwer5t6kl.getenjoyment[.]net cfr556yujk.onlinewebshop[.]net Domains cmieqf7yjs.sportsontheweb[.]net d18i529.onlinewebshop[.]net dh06ls9kg.onlinewebshop[.]net dofamini.com[.]ua doput5rg.myartsonline[.]com Domains edcv89ik.onlinewebshop[.]net ej7ieb9bn.myartsonline[.]com ezms1ez.mygamesonline[.]org fo27axr8z.getenjoyment[.]net fqw345rdxc.onlinewebshop[.]net Domains gp098ujm.scienceontheweb[.]net gstcg9g.mywebcommunity[.]org gy678ikjm.onlinewebshop[.]net h4s7hlkpo.getenjoyment[.]net hcdse34r.onlinewebshop[.]net Domains hnvg5lco.mywebcommunity[.]org idr45tgb.myartsonline[.]com jkio954rt.medianewsonline[.]com jklo8yghj.scienceontheweb[.]net ke45tyghnj.mygamesonline[.]org Domains ki876tgvb.mypressonline[.]com kovalenko.dothome.co[.]kr mailsecurity.serveirc[.]com mf3goke.getenjoyment[.]net minecrafter.mygamesonline[.]org Domains msx2z9wy9.onlinewebshop[.]net mykolapalinchak.medianewsonline[.]com nimdm8cx87.mygamesonline[.]org ny6r3kijc.mypressonline[.]com oh8e6hd7ip.getenjoyment[.]net Domains oy51g1vt.getenjoyment[.]net oz9ffohqb.mywebcommunity[.]org p1o2i3u4y5t6r7e8w9q0.medianewsonline[.]com pokijhgcfsdfghnj.mywebcommunity[.]org qvck223mxo9.onlinewebshop[.]net Domains qweasdzxc.mygamesonline[.]org rty789ijnh.medianewsonline[.]com sclmu1lnils.scienceontheweb[.]net se4567yuhn.sportsontheweb[.]net security-zooma.serveirc[.]com Domains security-profile.serveirc[.]com svpiwsw.mypressonline[.]com t1b2a3vy.onlinewebshop[.]net tgg7ujhn.myartsonline[.]com vyt01cq8o1.atwebpages[.]com Domains w346yjkiu.onlinewebshop[.]net w50dleqwo0d.getenjoyment[.]net wersdfxcv.mygamesonline[.]org xv57j3d.scienceontheweb[.]net yrfghjk652u.mygamesonline[.]org Domains yyjybdrq4.scienceontheweb[.]net zvwb1ep7i.onlinewebshop[.]net Email Indicators These addresses are reproduced from the source’s formal email IoC list. Their inclusion does not mean each address performed the same role in every attack. Type Published indicators Email addresses babiest26@outlook[.]com baras6600@daum[.]net baras6600@hotmail[.]com baras6600@proton[.]me choemiyang@hotmail[.]com Email addresses davidmaximy@outlook[.]com davidmaximy@proton[.]me dustinharrise91@outlook[.]com hazama09093@outlook[.]com info.seclab.noreply@gmail[.]com Email addresses jamejacky55@proton[.]me jamestony88@proton[.]me jamjack2026@proton[.]me jsykukbang18@kakao[.]com kcscon@proton[.]me Email addresses ken0723@kakao[.]com killer05121@outlook[.]com leomsoite@gmail[.]com montry111@proton[.]me murayamasi26@outlook[.]com Email addresses nemotom@outlook[.]kr omski00@outlook[.]com payuser2026@outlook[.]com pooh04211@outlook[.]com skmotern2003@outlook[.]com Email addresses srahnn21@gmail[.]com sven5500@outlook[.]com sven5500@proton[.]me taini7700@daum[.]net taini7700@outlook[.]com Email addresses taini7700@proton[.]me urusa4400@proton[.]me void0824@proton[.]me xufeng.wangsui@hotmail[.]com yaosiyaosi26@hotmail[.]com Email addresses youth3920@outlook[.]com zhejiong.hangjou@hotmail[.]com Additional Source-Reported Hunting Indicators These technical artifacts come from the report’s analysis sections. Filenames, paths, and task names should be matched with suspicious execution or network activity, not treated as proof of compromise on their own. Indicator type Source-reported value Role or context Indicator type Source-reported value Role or context GitLab repository paths kickball12/bahubali galata20/shiba Shared delivery infrastructure in the conference and research-report attacks. Related GitLab repository keresman Contained Japanese decoy material and related scripts. GitHub raw-content repository path raw.githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh Hosted the September shortcut payloads. Conference archives KCSCON_2026_Official_Invitation.zip KCSCON_Official Invitation Letter.zip Follow-up phishing attachments. Conference shortcut files KCSCON_2026_Official_Invitation.pdf.lnk KCSCON_Official Invitation Letter_en.pdf.lnk Malicious shortcuts disguised as PDF invitations. Conference decoy files KCSCON_2026_Official_Invitation.html kcs.pdf Invitation content used to reduce suspicion. Research-report shortcuts Аналітичний_звіт_Наталії.pdf.lnk Natalia B*******_Analytic.pdf.lnk Ukrainian and English report-themed variants; the source masks part of a person’s name. September shortcuts A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf.lnk CV_SocialResearcher_Sociologist_Qualitative.lnk Peace-report and researcher CV lures. Initial and follow-up scripts first.ini help.ini Disguised script components used for loading, collection, upload, and persistence. Local VBE paths C:\Users\Public\Music\apple.vbe C:\Users\Public\Music\shiba.vbe C:\Users\Public\Music\shibaa.vbe Downloaded or modified scripts used in the GitLab delivery chain. Decoy PDF paths C:\Users\Public\Music\kcs.pdf C:\Users\Public\Music\aa.pdf Locally saved decoy documents. Google-themed scheduled task GoogleUpdateTaskMachineUA{1C791230-CA8D-6D04-AC55-E498ABE7C33} Runs the modified VBE script every 15 minutes. Uploaded filename patterns SYS_yyyy-MM-dd_HHmm.tmp DOWN_yyyy-MM-dd_HHmm.tmp System information and Downloads-folder listings uploaded to GitHub. GitHub payload filenames LICENSE okay.md VBScript and PowerShell disguised as ordinary repository files. AppData payload paths %APPDATA%\update1.vbs %APPDATA%\update2.ps1 September persistence and remote-task components. OneDrive-themed scheduled task OneDriveUpdateScheduler Repeats execution every minute. TCP control endpoint 111.92.246[.]145:12345 Receives connections from the September PowerShell payload and fake Zoom installer payload. Embedded authentication string MySecurePass123 Plaintext password reported in the fake Zoom installer’s PowerShell component. Remote task filename patterns qqq*.ps1 ddd*.txt Additional PowerShell scripts and task files requested from the control server. Decoy PDF URL kovalenko.dothome.co[.]kr/media/A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf Peace-report decoy. Decoy PDF URL dofamini.com[.]ua/media/CV_SocialResearcher_Sociologist_Qualitative.pdf Researcher CV decoy. Auxiliary loader endpoint p1o2i3u4y5t6r7e8w9q0.medianewsonline[.]com/login.php Loader found in README.md ; the report did not establish its execution in the analyzed September shortcut chain. Fake installer filename zoominstaller.exe Unsigned malicious executable hosted in a separate GitHub repository. Fake installer payload paths C:\Users\Public\Videos\desktop.ps1 C:\Users\Public\Videos\desktop.vbs Scripts dropped by the malicious installer. Zoom-themed scheduled task Zoom-Auto-Installer Runs the VBS payload through wscript.exe every minute. Phishing domain and resolved IP security-zooma.serveirc[.]com 85.155.224[.]59 Fake meeting login infrastructure observed during analysis. Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data appeared first on Cyber Security News .

North Korea-linked cyber espionage group Kimsuky has expanded its Operation GitPower campaign by using fake Zoom installers.

At a glance Actor Kimsuky, a North Korea-linked threat group (assessed by Genians) Activity Reply-baiting spear phishing, malicious LNK files, fake Zoom installer, credential phishing Targets Ukrainian experts in diplomacy, security, and international policy Scale Several individual targets; Genians says most attempts failed Status No law-enforcement action reported Source

北朝鮮と関連するサイバースパイ集団Kimsukyが、「Operation GitPower」キャンペーンを拡大しています。偽のZoomインストーラーと悪意あるWindowsショートカットファイルを使い、外交、安全保障、国際政策に携わるウクライナの専門家を狙っています。Securityincident response

Analyze Kimsuky’s Operation GitPower, including malware delivery and C2 communication via GitHub and GitLab, as well as reply-driven spear-phishing attacks

Analyze Kimsuky’s Operation GitPower, including malware delivery and C2 communication via GitHub and GitLab, as well as reply-driven spear-phishing attacks

North Korea-linked threat actor Kimsuky has expanded its Operation GitPower activity with malicious LNK shortcuts, GitHub Personal Access Token (PAT).

North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling.

北朝鮮系脅威アクター「キムスキー(Kimsuky)」が、悪意あるLNKショートカット、GitHubパーソナルアクセストークン(PAT)による認証を伴うペイロード配信、そしてOpenCodeコーディングエージェントに関連するAI生成おとり文書を組み合わせ、「Operation GitPower」の活動範囲を拡大している

セキュリティ研究者らは、北朝鮮とつながりのあるKimsukyのハッカーが人工知能を利用し、日常的な業務ファイルに見せかけたフィッシング文書を短時間で大量作成している新たな証拠を発見しました。 「Operation GitPower」と名付けられたこのキャンペーンは、AIで作成した偽装文書と、悪意のあるWindowsシ

Cet article analyse l'Opération GitPower, une campagne d'espionnage cyber attribuée au groupe nord-coréen Kimsuky, détaillée initialement par le Genians Security Center.

北朝鮮の国家支援型脅威アクターKimsukyが、自前でホストするAI(人工知能)ツールを取り入れる形で、確立済みのスパイ活動の手口を拡張していることが、「Operation GitPower」として追跡されている活動クラスターに関する新たな調査で明らかになりました。 今回のキャンペーンは、これまでと同様にフィッシング

北朝鮮の脅威アクター「キムスキー(Kimsuky)」が、研究者らが「Operation GitPower」と呼ぶキャンペーンの一環として、ローカルの人工知能ツールをサイバースパイ活動の武器庫に加えていることが分かりました。 この活動では、同グループが常用するスピアフィッシング手法、悪意のあるWindowsショートカッ

Kimsuky, the North Korean espionage group, has expanded a campaign known as Operation GitPower with a local artificial intelligence development setup. It combines phishing emails with tools that may help create lures, review stolen material, and adapt operations faster. The entry point remains simple but effective. Targets receive ZIP archives containing Windows shortcut, or LNK, files dressed up as correspondence, research material, embassy messages, financial records, legal documents, or event information. Opening one starts concealed PowerShell code while a document appears to keep the victim from noticing. Analysts at Polyswarm identified the activity as a continuation of Kimsuky’s established espionage work, not a new way of breaking into networks. The campaign appears focused on South Korean organizations in government, academia, diplomacy, military, security research, international cooperation, and virtual assets. Polyswarm said in a report shared with Cyber Security News (CSN) that the outcome could be a more efficient spying operation, not a wholly new type of malware. Kimsuky pursues durable access and intelligence collection, and this mix of social engineering, cloud infrastructure, and local AI could shorten campaign preparation and adjustment. Kimsuky Expands Its Cyber Espionage Arsenal The investigators found evidence of local model platforms, including Ollama, GPT4All, and Msty, on infrastructure tied to Operation GitPower. Local models let operators work with prompts and documents without an outside AI service. The researchers also found GPT4All LocalDocs, a feature that lets a model draw on documents supplied by its operator. This approach, called retrieval-augmented generation, can make a system answer questions from a dedicated collection of files. Other artifacts included databases, agent frameworks, model libraries, graphics support, and Whisper tooling. This points to an internal workspace beyond writing convincing text. It could support document review, translation, malware development, automation, and processing of stolen information. The finding matters because it suggests a repeatable capability that could improve existing operations while keeping sensitive work under the group’s control. AI-generated decoy files already show where this could have an immediate effect. Researchers observed financial, investment, and business-themed documents whose metadata, structure, formatting, and templates suggested automated generation. A separate report on  AI-assisted phishing operations  shows why polished messages and credible personas remain a growing concern for defenders. Phishing Chain Uses GitHub Infrastructure Operation GitPower still follows a recognizable intrusion path. A shortcut file launches an obfuscated PowerShell loader, establishes persistence with a scheduled task, and retrieves extra components from GitHub repositories. The group uses raw-content services and encrypted payloads made to look like image files, allowing harmful traffic to blend into a legitimate cloud platform. Investigators linked the campaign to AsyncRAT payloads stored in repositories and described GitHub as both a delivery location and a command-and-control channel. The approach echoes a  North Korean GitHub C2 campaign , where LNK lures and trusted developer infrastructure similarly obscured malicious communications. The scripts use Base64 encoding, split strings, custom decoding, fragmented web addresses, and hidden PowerShell windows to complicate inspection. These are familiar techniques, but local AI could make it easier to revise supporting code and decoys as defenders block samples or infrastructure. Similar use of  PowerShell and Dropbox infrastructure  underlines the group’s history of hiding within common online services. Security teams should treat a ZIP-delivered LNK file that launches cmd.exe or PowerShell as a high-priority signal. Detection should connect such activity with long command arguments, new files in Temp or AppData, hidden script execution, scheduled-task creation, and GitHub raw-content or API traffic. Reviewing image files that behave like encrypted executables can also expose the delivery chain. Organizations should not judge an email only by how professional its document appears. Behavior-based monitoring, rapid analysis of suspicious files, and regularly refreshed threat intelligence offer better protection when attackers can alter content and payloads quickly. The recent  Kimsuky local LLM activity  reinforces the value of watching the full execution chain rather than relying on static indicators alone. Indicators of compromise (IoCs):- Type Indicator Description SHA-256 981dadc1a7ab50d6ff600a69c904a350fcc2d2050ac94589321f51ac5527c78d PolySwarm-associated Operation GitPower sample SHA-256 18fa10ff013cf82974f00875e23dae48d4d2dc0993a348f8069dd32845de39a1 PolySwarm-associated Operation GitPower sample SHA-256 a4f72ce8b5736fe3ca2083cfe21bd51697f12e900e307c357cb8523b8f86e3ec PolySwarm-associated Operation GitPower sample SHA-256 9be8f2be7ad882e8423c269a0540b7c73d6470311ddfcfcd318ff9d1983e2935 PolySwarm-associated Operation GitPower sample SHA-256 2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e PolySwarm-associated Operation GitPower sample SHA-256 d185c71b58b1ebed730feb8bbb6568d80542d2b8228b2777d280a7a4b114fdd0 PolySwarm-associated Operation GitPower sample SHA-256 018c31af135a0bc5e068df26d866440b28164aa4a659ea7df47bcbaab4a898cd PolySwarm-associated Operation GitPower sample SHA-256 a40a61e54be9cc1671ea6832fef8139ce811a7d759058bb8b4ca86863f4cc1bd PolySwarm-associated Operation GitPower sample SHA-256 4d37b4ccd6e4c0c9de82e66e40dfb6412b92ea33bcf10442a290b0732eeadae0 PolySwarm-associated Operation GitPower sample SHA-256 863f1405a190e2d87f06c5a9383b91b660bf4a0cd1b7c1c4987a071ee1c7dbb1 PolySwarm-associated Operation GitPower sample SHA-256 24dd215bb0946dde131f8fd0a3cc4d9ab6c095c31f8b57fb62462105e9e57cc0 PolySwarm-associated Operation GitPower sample SHA-256 456ed6926b706c203ac65b5174ac2ce78a5dad2ef0f083ae1f0aedd75d811ca2 PolySwarm-associated Operation GitPower sample SHA-256 4453b9e985f452365995c399f5292c92764570f03e6a066d7845320dd4ad09a1 PolySwarm-associated Operation GitPower sample SHA-256 b50422ec3a98d098bb3f7d728012da7e1795221c8b0624562568dff87ab5de2a PolySwarm-associated Operation GitPower sample SHA-256 9d50b542ddc7f46aba4c621c503495ed7992d84f92fd89cbb240963636ae19d3 PolySwarm-associated Operation GitPower sample SHA-256 4b0358c7e4afa54bc489a6199cca132b5f4a330892eb15bf06c0c4da9e020df2 PolySwarm-associated Operation GitPower sample SHA-256 70a7f0aeda59f8563031b5ab4554b52f32118a96d197871181aca4ba91168cff PolySwarm-associated Operation GitPower sample SHA-256 22180919f562fb9f6e50d7f20b2eb3f94eb009c212b74b45cf77659fe8274d5b PolySwarm-associated Operation GitPower sample SHA-256 e49399502d455dbd38f1140bffa761701608526aefb7174646c2f8ffe881ae73 PolySwarm-associated Operation GitPower sample SHA-256 216ef271db7a1fe301bc4ca8cafb3849e4db57ff05a4bc6c146c13a026c6aa9c PolySwarm-associated Operation GitPower sample SHA-256 0432ae814945633b605c77d137bef96c7f84934c682aada69baa326dce781286 PolySwarm-associated Operation GitPower sample SHA-256 7bc61d1bbc90d66d9988fd3baacd7834b1d2dfefe6d4ac999a194bccb9ba7dfc PolySwarm-associated Operation GitPower sample SHA-256 531aacc5cfe1abb14aaf55a2128940db30c63cbc8d5f9846ff8608e566fecb88 PolySwarm-associated Operation GitPower sample SHA-256 5b1f75205cb79a8c8a3d8083f34b552852dfd567dd65763183b7536a29f55f5b PolySwarm-associated Operation GitPower sample SHA-256 e34d73a1da492c9a79a9729f2f7d9d4b5a2448f44934bd5552bd0bbbe1586767 PolySwarm-associated Operation GitPower sample SHA-256 5daf3d123d58bc15e7b3130bc7c33d29b422b6aa485c67f69fbe0ed0ea95d27f PolySwarm-associated Operation GitPower sample Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Stop new phishing & malware before they compromise your business.  Integrate live intel from 15K SOCs around the world The post Kimsuky Expands Its Cyber Espionage Arsenal With Local AI Development Environment appeared first on Cyber Security News .

Operation GitPower, a Kimsuky campaign, uses AI-generated lure documents and GitHub/GitLab-based C2 infrastructure to deliver malicious payloads.

Kimsuky has been observed blending polished AI-made documents with familiar phishing tactics to push AsyncRAT, a remote-access trojan. The campaign shows how old delivery methods can gain new credibility when the bait looks professionally written and carefully formatted. The activity, tracked as Operation GitPower, begins with ZIP archives carrying Windows shortcut files that appear to be ordinary documents. Opening one can launch concealed PowerShell code while a harmless-looking PDF opens on screen, reducing the chance that a target notices the compromise. Genians analysts identified the campaign after tracking infrastructure tied to GitHub- and GitLab-based activity. Genians said in a report shared with Cyber Security News (CSN) that the targets include diplomatic missions and military, security, virtual-asset, policy, and academic organizations. AI-Enabled Attack Flow (Source – Genians) The operational impact is wider than a single malicious file. Attackers can update scripts and payloads in public code repositories, use trusted web traffic to blend in, collect system details, and keep access through scheduled tasks. That makes early behavioral detection especially important, as a recent  North Korean GitHub C2 campaign  also illustrated. Kimsuky Uses Local LLMs, AI-Generated Lures and GitHub C2 The operators set up local language-model environments using Ollama, GPT4All, and Msty. Evidence also included a GPT4All LocalDocs database, suggesting that documents held by the group could be searched and used as an AI knowledge base. The researchers did not find evidence that the group trained its own models. Examples of Spear Phishing Emails (Source – Genians) Instead, the traces suggest a research and integration phase: testing locally run AI, document retrieval, automation frameworks, and speech-to-text tools that could help process stolen material or support future malware development. At the front of the intrusion, AI-generated decoys covered investment, virtual-asset, and game-development themes. Their polished language and consistent design can make the usual warning signs less reliable. Readers following  AI-assisted phishing campaigns  have seen the same broader problem: convincing content is no longer a useful safety test by itself. The shortcut loader hid a roughly 3,800-character PowerShell command, including a long run of spaces designed to obscure the important portion in Windows properties. It retrieved a decoy PDF through GitHub Raw Content, then created scripts in temporary and AppData locations and registered a hidden recurring task. Examples of PDF Decoy Documents (Source – Genians) GitHub served as more than a download point. The scripts fetched follow-on files and collected operating-system, hardware, boot-history, process, and network information. The collected data could then help operators decide how to continue the intrusion while normal GitHub access made the traffic less conspicuous. AsyncRAT Delivery and Defense Public repositories held files named apple.png, fox.png, lion.png, rabbit.png, and wolf.png, but the files were encrypted .NET AsyncRAT payloads rather than images. This disguise echoes other  AsyncRAT delivery techniques , where a legitimate-looking artifact hides a tool that can give attackers remote control of a compromised Windows system. The report linked apple.png and rabbit.png with rTom.exe_r, while other image-named payloads used a hard-coded command-and-control address. LNK File Command-Line Arguments (Source – Genians) The campaign also used string splitting, custom Base64 decoding, and altered file headers, small evasions that together complicate simple signature checks. Organizations should treat a ZIP-delivered LNK file launching cmd.exe or PowerShell as a high-priority signal, especially when it carries unusually long arguments. Detection teams should correlate that event with hidden PowerShell, new scripts in Temp or AppData, scheduled-task creation, GitHub Raw Content or Contents API traffic, non-business personal-access tokens, and image files that behave like encrypted executables. The practical lesson is to look at the sequence, not merely the lure. Block or investigate suspicious shortcut files before execution, restrict unnecessary script execution, and hunt for the combined behavior across endpoints and network logs. This approach also helps counter the  latest AsyncRAT cloud abuse , where trusted services can mask a multi-stage infection chain. AI may make phishing material faster to produce and harder to spot, but it does not remove the actions required to run malware, maintain access, and contact an operator. Defenders that join those events together can identify the campaign even when each individual action initially appears ordinary. Indicators of compromise (IoCs):- Type Indicator Description C2 IP address 112.216.9[.]171 AsyncRAT command-and-control address embedded in fox.png, leopard.png, lion.png, and wolf.png IP address 169.254.33[.]137 Address observed during testing alongside rTom.exe_r and AsyncRAT payloads IP address 170.205.29[.]83 Published IoC IP address 170.205.30[.]227 Published IoC IP address 185.27.134[.]140 Published IoC IP address 27.102.137[.]126 Published IoC IP address 27.102.137[.]159 Published IoC IP address 27.102.138[.]44 Published IoC Domain toks.great-site[.]net Published IoC Email address apollo1030109@gmail[.]com; awed33@outlook[.]kr; belendong40@gmail[.]com; brandonleeodd.93@gmail[.]com; contrasde@outlook[.]kr; devlion413@gmail[.]com Published IoCs Email address eros1030109@gmail[.]com; hera1030109@gmail[.]com; holowin401@gmail[.]com; holowin@gmail[.]com; jecoma@outlook[.]kr; johnstones19850308@gmail[.]com Published IoCs Email address johnstones8888@outlook[.]com; kkkkk79@outlook[.]kr; tomas3015@outlook[.]kr; trungvo5131993@gmail[.]com; tttsssuuu@outlook[.]kr; whitewolf20000312@gmail[.]com Published IoCs File name apple.png; fox.png; leopard.png; lion.png; rabbit.png; wolf.png RC4-encrypted .NET AsyncRAT payloads disguised as image files File name rTom.exe_r File stored alongside AsyncRAT payloads File name poqpwoqwdjoweij.ps1; irujkdnjhgttrhdkfdu.ps1; lpieuysjfgtrja.ps1; ms_update.ps1 PowerShell scripts used in the infection chain File name riudxkfngidruhkr.pdf; priujghtjytfcghffgt.txt; bhjfjkfgrtwehjbfgcf.txt Files retrieved through GitHub infrastructure Scheduled task ZHUYHJGTYTFSUHIPOKLKHJHUYGVHGNFH Hidden recurring task used for persistence MD5 502ebc2356f9f700bbdac444cdefa0da; 20d8ceb7dea7d471afa2f8e753b13d2d; 61f378c0efc13669dada1fe340c6837b; d2669731cb5ff664dfb5fbfc37637876 Published malware hashes MD5 d2ab3df4762fbde5d86e99a1ad147850; e2e76d5316663a3dc472398b1c01cb9a; 82eb77109cce1e8afca6245c2963e52a; 6302725413076d1aeaee2d7f2b369264 Published malware hashes MD5 630792a0c0dfad55fb2b19d3e30e9a7d; 430d5f17d5e3f85be18220a7cab0b9ff; f37cec428257cd41153cf43d7f1a1265; 23b9d40f3d620ec87960b4350d42ccc0 Published malware hashes MD5 33e2110d233d4543830e14c78d53900f; 4422a221851ea6ad15f53cd3aea51c8a; f49bdbe7e6cbb88842afcce3a9fe60e9; b4d87fef16790cbe1df72007d9914966 Published malware hashes MD5 55577fffb5b5acd3771ef9dc696498f1; e5af95590a33b9bc64d95808f1fc71b; 785c5672bb14e1d2f07a8318ffec19b; 2136add815cd61d6514f81a23ab8c23 Published malware hashes MD5 405a73ff669fc282653bd6c42cf87ade; 93377f12fa589f56f6203c692715b395; 8d308406075af0a1e9ec09bafdc0de01; f1388c859a03814443c6f0da341ee594 Published malware hashes MD5 c352a1c07ac866fb6b388e38c6bb1d4; bbe94a343d8bcf02a0554fa271452a51; 2f3cea435292106026e257789036a70e; e1a14a5701848f82c65a55765dc53411 Published malware hashes MD5 1899faa9d5dd632bb90addca480eaa5; ff4382af3fa7f22f6e97901f20326cc; 12bdb49b406ea5b8628cb7801f47c018; 9b96182b50dad56d891ef230656b37ce Published malware hashes MD5 62cdadab516ec6c6b37618ad65080a06; 3270ea4ba0238423b5c29667cd760ccd; 7b000aaba8e682a72c6a3e634c070f0; fb057bf5bbf1b0ab9fc27439de4386ed Published malware hashes MD5 7b8fc151c410055bfa198937825dfd7e; 41000e7ac63d021de798034cbf933e1; c99bcb83fc7723bf166ef08ff3112257; a1244f584ca0b57807f79f26e7f59 Published malware hashes Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Stop new phishing & malware before they compromise your business.  Integrate live intel from 15K SOCs around the world The post Kimsuky Uses Local LLMs, AI-Generated Lures and GitHub C2 to Deploy AsyncRAT appeared first on Cyber Security News .