Kimsuky Uses AI-Generated Decoys and Experiments with Local LLMs

Summary

Genians’ analysis of Kimsuky-linked Operation GitPower details spear-phishing attacks using malicious LNK files, PowerShell and Git-based C2, and evidence the group is experimenting with local LLMs and AI development tools.

Key points

• Genians tracks Operation GitPower as a continuation of Kimsuky activity, including tactics associated with the FlowerPower campaign.
• Spear-phishing ZIP archives contain LNK files disguised as business documents; execution launches obfuscated PowerShell and can display a decoy PDF while malicious activity continues.
• The attack establishes persistence with hidden scheduled tasks, collects system information and uses GitHub repositories for C2 and payload delivery.
• Encrypted .NET AsyncRAT payloads were disguised as image files; a hardcoded GitHub access token identified in the analysis has been revoked.
• Infrastructure logs showed Ollama, GPT4All and Msty installations, GPT4All RAG configuration, and AI development materials. The report found no evidence of independent AI model training.
• Genians recommends correlating LNK execution, unusual PowerShell, scheduled tasks and Git service access through behavior-based detection and threat hunting.

Indicators of compromise

MITRE ATT&CK

People

Threat Actors

Malware

Vendors

Products

Tools

Countries

Industries

Related Articles

• Malicious Go Module Reveals 222-Repository GitHub Malware Lure NetworkAsyncRAT · GitHub · Microsoft Defender
• Kimsuky-Linked Campaign Uses Malicious LNKs, GitHub PATs and AI-Generated DecoysKimsuky · Genian Insights E · GitHub
• CapFix Uses Evolving CapDoor Malware in Attacks on Russian OrganizationsAsyncRAT · T1027 · T1059.001
• Zscaler Details SloppyRAT, a New Malware Linked to Ransomware AttacksMicrosoft Defender · T1027 · T1057
• UAT-11795 Uses Starland RAT and Custom WLDR C2 Implant in Financially Motivated CampaignT1027 · T1053.005 · T1059.001