Kimsuky deploys AsyncRAT via AI lures, local LLMs, and GitHub C2

Key Takeaways

• The Kimsuky threat group is employing sophisticated tactics, including AI-generated phishing lures and local Large Language Models (LLMs), to distribute the AsyncRAT remote access trojan.
• The campaign, dubbed “Operation GitPower,” leverages ZIP archives containing malicious Windows shortcut files that masquerade as legitimate documents.
• Targets include high-value entities such as diplomatic missions, military organizations, security firms, virtual-asset companies, policy groups, and academic institutions.
• Attackers are using GitHub and GitLab repositories for command-and-control (C2) infrastructure, enabling dynamic updates to scripts and payloads while blending malicious traffic with legitimate web activity.
• The use of AI to craft convincing lures makes traditional phishing detection methods based on content quality less effective, underscoring the need for advanced behavioral analysis.

Kimsuky Leverages AI and GitHub for AsyncRAT Deployment

The notorious Kimsuky advanced persistent threat (APT) group has integrated advanced techniques, specifically utilizing AI-generated documents and local Large Language Models (LLMs), to bolster its phishing campaigns and deploy the AsyncRAT remote-access trojan. This evolution in tactics showcases how established delivery methods can gain enhanced credibility when coupled with professionally crafted, AI-generated content, making malicious lures significantly more deceptive.

Analysts have designated this ongoing activity as “Operation GitPower.” The initial phase of the attack involves distributing ZIP archives that contain Windows shortcut (.LNK) files. These files are meticulously designed to appear as benign documents. When a target opens one of these seemingly innocuous shortcuts, a hidden PowerShell script is executed in the background, while a legitimate-looking PDF document simultaneously opens on the screen. This dual action significantly reduces the likelihood that a victim will detect the underlying compromise, as detailed in a comprehensive report.

Operation GitPower: Targeting High-Value Organizations

Genians, a cybersecurity firm, uncovered this campaign by meticulously tracking infrastructure associated with GitHub and GitLab activity. According to Genians said in a report shared with Cyber Security News (CSN), the targets of Operation GitPower are diverse but consistently high-value. They include diplomatic entities, military and security organizations, companies involved in virtual assets, policy-making bodies, and academic institutions. The strategic choice of targets underscores Kimsuky’s persistent focus on intelligence gathering and disruption.

The operational implications of this campaign extend far beyond the initial malware delivery. By leveraging public code repositories, Kimsuky operators can seamlessly update their scripts and payloads, ensuring adaptability and resilience. The use of legitimate web traffic for command-and-control (C2) operations allows the malicious communications to blend in with normal network activity, making them harder to detect. Furthermore, the malware is designed to collect extensive system details and establish persistence through scheduled tasks, enabling sustained access to compromised environments. This multi-faceted approach highlights the critical importance of early behavioral detection, a lesson reinforced by a recent North Korean GitHub C2 campaign.

Kimsuky’s AI Integration and Lure Sophistication

The Kimsuky operators have established local language model environments using tools like Ollama, GPT4All, and Msty. Researchers also discovered a GPT4All LocalDocs database, suggesting the group may be indexing and utilizing its own collection of documents as an AI knowledge base. This implies a strategic move towards leveraging AI for content generation and information processing within their malicious operations.

While direct evidence of the group training its own large language models has not been found, the existing traces indicate a clear phase of research and integration. Kimsuky is actively experimenting with locally run AI, document retrieval systems, automation frameworks, and speech-to-text tools. These capabilities could potentially be used to process exfiltrated data more efficiently or to aid in the development of future, more advanced malware.

The initial stages of the intrusion heavily rely on AI-generated decoy documents. These lures cover a range of topics, including investment opportunities, virtual assets, and game development. The sophisticated language and consistent, professional design of these documents make traditional warning signs of phishing, such as grammatical errors or awkward phrasing, less reliable. This broader issue of AI-assisted phishing campaigns illustrates that convincing content alone is no longer a reliable indicator of safety.

The shortcut loader itself contains a PowerShell command, approximately 3,800 characters long, strategically padded with numerous spaces to conceal the critical malicious portion when viewed in Windows properties. This command retrieves a decoy PDF file from GitHub Raw Content, then creates additional scripts in temporary and AppData directories, and finally registers a hidden recurring task for persistence.

GitHub’s role in this campaign extends beyond a mere download server. The scripts actively fetch subsequent files and gather extensive information about the compromised system, including operating system details, hardware specifications, boot history, running processes, and network configurations. This collected intelligence allows the attackers to tailor their subsequent actions, while the use of GitHub for C2 operations helps the malicious traffic evade detection due to its resemblance to legitimate development activity.

AsyncRAT Delivery and Defense

Public GitHub repositories were found to host files named apple.png, fox.png, lion.png, rabbit.png, and wolf.png. However, these files were not images; they were RC4-encrypted .NET AsyncRAT payloads. This deceptive naming convention mirrors other AsyncRAT delivery techniques, where a seemingly legitimate file conceals a powerful tool capable of granting attackers full remote control over a compromised Windows system.

The Genians report specifically linked apple.png and rabbit.png to a file named rTom.exe_r, while other image-named payloads utilized a hard-coded command-and-control address (112.216.9[.]171). The campaign also incorporated various evasion techniques, including string splitting, custom Base64 decoding, and modifications to file headers. These minor alterations, when combined, effectively complicate straightforward signature-based detection methods, emphasizing the need for more dynamic and behavioral analysis.

What You Should Do

• Enhance Endpoint Detection and Response (EDR): Prioritize and investigate any suspicious activity involving ZIP-delivered LNK files that initiate cmd.exe or PowerShell, especially if they contain unusually long command-line arguments.
• Monitor for Anomalous PowerShell Activity: Implement robust logging and monitoring for hidden PowerShell processes and the creation of new scripts in sensitive directories like Temp or AppData.
• Scrutinize Scheduled Tasks: Regularly audit and monitor for newly created or modified scheduled tasks, particularly those with obscure names or unusual execution patterns.
• Analyze GitHub/GitLab Traffic: Pay close attention to network traffic related to GitHub Raw Content or the Contents API, especially if it originates from non-development systems or involves personal access tokens that are not explicitly authorized for business use.
• Inspect File Types and Content: Employ advanced threat intelligence and file analysis tools to identify files disguised as common image formats (e.g., .png) but exhibiting characteristics of encrypted executables.
• Implement Behavioral Analysis: Shift focus from solely signature-based detection to a comprehensive behavioral approach. Correlate multiple seemingly benign events across endpoints and network logs to identify the complete attack chain.
• Educate Users: Conduct regular security awareness training, emphasizing the dangers of opening unexpected attachments, even if they appear legitimate or are from known senders, given the rise of AI-generated convincing lures.
• Restrict Script Execution: Implement policies to restrict or limit the execution of PowerShell and other scripting languages to authorized personnel and applications.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.