Kimsuky Uses GitHub and Phishing Lures in Espionage Campaign Targeting Ukrainian Experts
Summary
Genians links Operation GitPower to Kimsuky attacks on Ukrainian experts, detailing reply-baiting phishing, malicious LNK files and Zoom installers, Git-based delivery and exfiltration, persistent PowerShell payloads, and credential theft.
Key points
- The report attributes attacks targeting Ukrainian diplomacy, security, and international-policy experts to North Korea-linked Kimsuky, based on shared code, infrastructure, and execution patterns.
- Reply-baiting emails posed as conference invitations or research collaboration; malicious files or credential-phishing links were sent after targets engaged.
- LNK files disguised as PDFs and a fake Zoom installer launched VBE and PowerShell payloads, often through hidden execution and scheduled tasks.
- The attackers abused Codeberg, GitLab, and GitHub to deliver files, retrieve commands, and exfiltrate system information and file listings; some variants also used a separate TCP command-and-control server.
- A phishing follow-up impersonated a Google Meet or Zoom invitation and directed victims to a nonofficial domain to steal credentials.
- The analysis found related decoy documents and infrastructure suggesting the same framework may also have targeted Japanese speakers and other audiences.
- Genians recommends correlating endpoint behavior—including LNK launches, script execution, scheduled tasks, repository access, and outbound transfers—rather than relying only on domain blocking.
Article Details
- Attack Vectors
- Reply-baiting spear phishing impersonated conference organizers and policy researchers, withholding malicious attachments or download links until recipients responded.
- ZIP archives delivered PDF-disguised LNK files that launched command interpreters, downloaded scripts from development repositories, and executed VBE payloads. Some archives were password-protected.
- Follow-up meeting invitations directed recipients to a Zoom-themed credential-phishing site.
- LNK files disguised as peace-policy reports or CVs downloaded VBS and PowerShell payloads that established scheduled-task persistence and contacted a separate TCP C2 server.
- An unsigned executable posing as a Zoom installer deployed malicious scripts and scheduled tasks before downloading and running the legitimate installer.
- Defensive Notes
- Correlate archive-contained LNK execution with subsequent cmd.exe, curl.exe, PowerShell, and wscript.exe activity rather than evaluating each event separately.
- Investigate scripts downloaded under INI or ordinary document filenames, especially when saved as executable scripts in public user directories or %APPDATA%.
- Hunt for scheduled tasks imitating software updates and repeatedly executing scripts at intervals of 1, 15, or 30 minutes.
- Monitor system-information collection, Downloads directory enumeration, GitHub Contents API uploads using hardcoded tokens, and deletion of collection files after transmission.
- Investigate TCP connections to port 12345 associated with repeated PowerShell execution and subsequent file transfers.
- Assess installer signatures, generated scripts, scheduled tasks, and external communications together; a legitimate installation screen does not establish that the initiating executable is safe.
- Analyze repository access in conjunction with process ancestry, command lines, local file creation, and subsequent execution instead of indiscriminately blocking development platforms.
- Genians reported that most observed attempts against the Ukrainian individuals were unsuccessful.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dofamini[.]com[.]ua | Attack-used host serving a CV-themed decoy PDF referenced by a malicious LNK; also explicitly listed in the domain IOC section. |
| DOMAIN | kovalenko[.]dothome[.]co[.]kr | Attack-used host serving a decoy PDF downloaded by a malicious LNK; also explicitly listed in the domain IOC section. |
| DOMAIN | mailsecurity[.]serveirc[.]com | Phishing domain used in a related attack targeting experts on North Korea in South Korea. |
| DOMAIN | mykolapalinchak[.]medianewsonline[.]com | C2 subdomain reported in the earlier TA406 attacks for follow-up scripts, infected-system information transfer, and commands. |
| DOMAIN | p1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]com | Auxiliary PowerShell loader endpoint receiving user-domain and account identifiers and returning code for in-memory execution; its inclusion in the analyzed LNK execution chain was not established. |
| DOMAIN | pokijhgcfsdfghnj[.]mywebcommunity[.]org | C2 subdomain reported in the earlier TA406 attacks for follow-up scripts, infected-system information transfer, and commands. |
| DOMAIN | qweasdzxc[.]mygamesonline[.]org | C2 subdomain reported in the earlier TA406 attacks for follow-up scripts, infected-system information transfer, and commands. |
| DOMAIN | security-profile[.]serveirc[.]com | Listed as threat infrastructure in the report's domain IOC section. |
| DOMAIN | security-zooma[.]serveirc[.]com | Credential-phishing domain sent in a follow-up email posing as an online meeting invitation. |
| DOMAIN | wersdfxcv[.]mygamesonline[.]org | C2 subdomain reported in the earlier TA406 attacks for follow-up scripts, infected-system information transfer, and commands. |
info[.]seclab[.]noreply@gmail[.]com | Account shared across conference-invitation and analytical-collaboration spear-phishing cases, providing a link between the attacks. | |
kcscon@proton[.]me | Sender account used to impersonate the conference organizing committee in speaker-invitation spear phishing. | |
ken0723@kakao[.]com | Account identified in commit metadata for the malicious first.ini loader. | |
| IPV4 | 103[.]153[.]65[.]67 | Listed as C2 infrastructure in the report's IOC section. |
| IPV4 | 111[.]92[.]246[.]145 | Hardcoded TCP C2 server contacted on port 12345 by the repository-delivered and fake Zoom installer PowerShell payloads for task delivery and result exfiltration. |
| IPV4 | 169[.]197[.]85[.]174 | Listed as C2 infrastructure in the report's IOC section. |
| IPV4 | 195[.]250[.]24[.]113 | Listed as C2 infrastructure in the report's IOC section. |
| IPV4 | 45[.]150[.]109[.]102 | Listed as C2 infrastructure in the report's IOC section. |
| IPV4 | 85[.]155[.]224[.]59 | IP address to which the Zoom-themed credential-phishing domain resolved at the time of analysis. |
| MD5 | 05cec01db363488e6762097095d7b7fc | Malicious-file indicator listed in the report's MD5 IOC section; the specific file association is not disclosed. |
| MD5 | 4f5694f61b4c244cc2269c3a5eb8a7c7 | Malicious-file indicator listed in the report's MD5 IOC section; the specific file association is not disclosed. |
| MD5 | 9b33a10f7637c7ce9e5e8aa1ed7303dd | Malicious-file indicator listed in the report's MD5 IOC section; the specific file association is not disclosed. |
| MD5 | fa87911771a52e3c1ffb1c39da59540c | Malicious-file indicator listed in the report's MD5 IOC section; the specific file association is not disclosed. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationScripts concealed commands using Base64 encoding and inserted strings that were removed with Replace() before execution.T1036.007 · Double File ExtensionShortcut filenames inserted .pdf before .lnk and used PDF icons to appear to be legitimate documents.T1053.005 · Scheduled TaskPayloads created scheduled tasks imitating Google, OneDrive, or Zoom components to repeat script execution every minute or every 15 minutes.T1059.001 · PowerShellDownloaded PowerShell scripts collected information, registered persistence, contacted C2, and executed additional scripts, often with execution policy bypassed.T1059.003 · Windows Command ShellMalicious LNK files invoked cmd.exe to download files with curl and launch downloaded VBE scripts.T1059.005 · Visual BasicVBE and VBS payloads executed through wscript.exe and launched follow-up PowerShell code.T1070.004 · File DeletionPayloads deleted temporary collection files, initial scripts, and successfully transferred result files to reduce traces.T1082 · System Information Discoveryhelp.ini collected systeminfo output and used the computer name to organize host-specific commands and uploaded information.T1083 · File and Directory DiscoveryScripts enumerated the user's Downloads folder and compared files in C:\Users\Public before and after additional task execution.T1105 · Ingress Tool TransferLNK files and loaders downloaded follow-up scripts from development repositories, and TCP C2 delivered additional PowerShell task files.T1140 · Deobfuscate/Decode Files or InformationThe fake Zoom installer used CryptStringToBinaryA to decode embedded Base64 scripts before writing desktop.ps1 and desktop.vbs.T1204.002 · Malicious FileTargets were encouraged to open PDF-disguised LNK files or an executable disguised as a Zoom installer.T1566.001 · Spearphishing AttachmentFollow-up conference-invitation emails delivered ZIP archives containing malicious LNK files.T1566.002 · Spearphishing LinkAnalytical-collaboration emails supplied a Codeberg archive download link, while later meeting invitations supplied a credential-phishing link.T1567.001 · Exfiltration to Code Repositoryhelp.ini Base64-encoded collected information and uploaded it to host-specific repository paths through the GitHub Contents API using a hardcoded token.
People
Threat Actors
KimsukyGenians assesses that the attacks targeting Ukrainian experts are linked to this North Korea-linked group through shared infrastructure, script implementation, persistence, and exfiltration patterns.KonniMentioned as another vendor tracking name whose activity partially overlaps TA406, according to Proofpoint; the source does not establish complete equivalence.TA406Proofpoint reported spear phishing against Ukrainian government agencies and assessed with high confidence that this cluster operates for the North Korean government; its activity partially overlaps activity tracked as Kimsuky and Konni.
Vendors
Products
CodebergCodeberg was used to distribute malicious archives, GitLab to provide files disguised as legitimate documents and malicious scripts, and GitHub to deliver commands and transmit collected information.Genian Insights EIntegrated Response Strategy Using "Genian Insights E"GitHubNeed to strengthen EDR detection and threat hunting for the abuse of LNK files, PowerShell, and GitHubGitLabGenians Security Center continues to track threat activity under Operation GitPower, in which Kimsuky, a threat group known to be linked to North Korea, abuses multiple legitimate services, including GitHub and GitLab.Microsoft WindowsIn Windows, the actual ".lnk" extension is not displayed, so users can mistake the file for a legitimate PDF document.ZoomLinks to earlier CHM attack tactics identified in malicious LNK files and malware disguised as Zoom installers
Tools
Countries
Japangrowing military cooperation between Russia and North Korea and the security policies of South Korea and Japan, and asked the recipient to review it before publication.North KoreaGenians Security Center continues to track threat activity under Operation GitPower, in which Kimsuky, a threat group known to be linked to North Korea, abuses multiple legitimate services, including GitHub and GitLab.RussiaIn particular, the threat actor has carried out persistent and relentless attacks against Ukrainian civil society figures working to repair war damage and rebuild the country following Russia’s invasion of Ukraine.South KoreaPossible state-sponsored cyber espionage targeting developments in cooperation between South Korea and UkraineUkrainePossible state-sponsored cyber espionage targeting developments in cooperation between South Korea and Ukraine
Industries
Civil societyIn particular, the threat actor has carried out persistent and relentless attacks against Ukrainian civil society figures working to repair war damage and rebuild the country following Russia’s invasion of Ukraine.defense contractorsKimsuky has continued to use spear phishing to compromise accounts and distribute malware, targeting government agencies, defense contractors, research institutions, and experts in diplomacy and security, among others.government agenciesa North Korea-linked threat group, had been conducting spear phishing attacks against Ukrainian government agencies since February of that year.research institutionsKimsuky has continued to use spear phishing to compromise accounts and distribute malware, targeting government agencies, defense contractors, research institutions, and experts in diplomacy and security, among others.