Kimsuky Hackers Use GitHub in GitPower Attacks to Deliver Malware

Key Takeaways

• The North Korean state-sponsored threat group Kimsuky is actively leveraging legitimate code hosting platforms like GitHub, GitLab, and Codeberg in a campaign dubbed “Operation GitPower.”
• The attacks primarily target Ukrainian individuals involved in diplomacy, security, and international policy through sophisticated spear-phishing tactics.
• Attackers use fake conference invitations and research requests to establish trust, delivering malware via malicious shortcut files disguised as PDFs or through fake software installers.
• The malware establishes persistence, collects system information, and exfiltrates data using GitHub’s API, showcasing Kimsuky’s evolving TTPs.
• While most observed attacks against Ukrainian targets were unsuccessful, the campaign highlights the persistent threat posed by this advanced persistent threat (APT) group.

The North Korea-backed hacking collective Kimsuky is employing a sophisticated campaign, dubbed “Operation GitPower,” to distribute malware, execute remote commands, and exfiltrate sensitive data. The group is exploiting popular code hosting platforms such as GitHub, GitLab, and Codeberg to target Ukrainian specialists in diplomacy, national security, and international policy. These platforms serve as trusted infrastructure for delivering malicious payloads and managing command and control (C2) communications.

Operation GitPower integrates highly tailored spear-phishing emails, counterfeit PDF documents, and Windows scripting to transform routine professional communications into potential vectors for cyber espionage. The attackers craft convincing lures, including invitations to conferences and requests for research feedback, to cultivate trust before delivering their harmful files.

Kimsuky’s Evolving Attack Chain

Researchers from Genians identified this activity in an October 12, 2026 report, establishing a link to earlier Operation GitPower attacks through consistent code patterns, file naming conventions, scheduled tasks, and data exfiltration methodologies. The findings underscore Kimsuky’s adaptability in email themes while maintaining a stable underlying attack framework.

A notable attack, initiated on August 6, began with a fraudulent invitation to the Korea Cyber Security Conference. The email meticulously mimicked genuine event details, lauded the recipient’s professional contributions, and even offered travel and honorarium support. Unlike previous Kimsuky campaigns that directly embedded malicious links, this particular initial contact contained no immediate threat.

The malicious payload was only delivered after the target responded to the initial email. The attacker then sent a ZIP archive purportedly containing invitation materials. Later iterations of this tactic involved password-protecting the archive, a move assessed by researchers as an attempt to evade detection by email security solutions. Inside these archives, a seemingly authentic HTML invitation masked a Windows shortcut file, cleverly disguised with a .pdf extension.

Another variant, observed on August 19, involved the impersonation of a policy researcher seeking input on a report concerning Russia and North Korea. Following a reply from the target, the attacker provided a download link hosted on Codeberg. When this initial malware delivery failed, a subsequent September follow-up shifted tactics, directing the victim to a fake meeting login page designed to harvest credentials.

Upon execution, the malicious shortcut initiates cmd.exe, which then utilizes curl to download additional files from GitLab. In some versions, a decoy PDF document is displayed to the user while a VBE script is silently downloaded and executed in the background. This initial script subsequently retrieves an in-memory follow-up component.

The loader component employs a technique to obfuscate PowerShell commands by embedding irrelevant words, which are then stripped using the Replace() function just prior to execution. The follow-up script establishes a persistent scheduled task, masquerading as a Google update, which runs every 15 minutes. This task is designed to collect system information and a directory listing of the user’s Downloads folder, rather than indiscriminately exfiltrating all files.

GitHub for Malware Delivery and Data Exfiltration

Exfiltrated information is Base64 encoded and then uploaded to GitHub via its Contents API, using a hardcoded access token. After successful data transmission, temporary files and the initial scripts are promptly deleted to cover tracks. This pattern of GitHub usage and recurring tasks aligns with Kimsuky’s previously documented AI phishing campaigns, although those earlier attacks featured AsyncRAT payloads, which were not conclusively observed in this specific Ukrainian attack chain.

Other samples from September utilized “peace-report” and “researcher résumé” themes. Their associated shortcuts downloaded files named LICENSE and okay.md from GitHub; however, these seemingly innocuous files actually contained VBScript and PowerShell code. A scheduled task, disguised as a OneDrive update, was configured to execute every minute, enabling a separate command and control server to push additional scripts and retrieve generated files.

The threat group also deployed an unsigned, 64-bit fake Zoom installer within a public GitHub repository. This installer, once executed, drops hidden scripts, creates a scheduled task that runs every minute, and connects to the same control server used by the September shortcut samples. Crucially, it then proceeds to download and launch the legitimate Zoom installer, presenting users with a familiar installation interface while the malicious software operates stealthily in the background. A detailed analysis is available in Genians’ report on Operation GitPower.

The broader GitPower operation has also incorporated Kimsuky OpenCode phishing decoys in prior research, demonstrating the group’s ability to vary its lures while maintaining a consistent script-based attack methodology. Genians attributed the Ukrainian campaign to Kimsuky based on a combination of technical evidence, moving beyond mere shared infrastructure or email subjects.

Genians posits that the targeting aligns with North Korea’s intelligence gathering objectives related to the ongoing conflict in Ukraine and the deepening cooperation between South Korea and Ukraine. Furthermore, Japanese decoy documents found in related repositories suggest a potential interest in Japanese-speaking targets, though successful compromises in this context have not been confirmed. It’s important to note that the report does not confirm that every file stored in these repositories successfully reached a victim.

What You Should Do

• Enhance Email Security: Implement advanced email filtering solutions that can detect spear-phishing attempts, especially those with unusual attachments or links to code repositories.
• Educate Users: Conduct regular cybersecurity awareness training, emphasizing the dangers of opening unexpected attachments, clicking suspicious links, or enabling macros, even if the sender appears legitimate. Train users to scrutinize email senders and content for anomalies.
• Monitor Endpoint Activity: Focus on linking endpoint events rather than simply blocking entire development platforms. Look for suspicious process chains, such as cmd.exe launching curl or hidden PowerShell scripts, new script files being created, “update”-themed scheduled tasks, GitHub API uploads, and unusual network connections.
• Verify Software Installers: Always verify the digital signatures of software installers and monitor their background activities. A legitimate installation screen does not guarantee that the launching executable is benign.
• Implement Network Monitoring: Monitor for connections to known C2 IP addresses and domains associated with Kimsuky and Operation GitPower. Utilize the provided Indicators of Compromise (IoCs) in your threat intelligence platforms.
• Regularly Patch and Update Systems: Ensure all operating systems, applications, and security software are kept up-to-date to mitigate known vulnerabilities.

Indicators of Compromise (IoCs)

File Hashes

All hashes in this table are MD5 values published in the source’s IoC section.

Network Indicators

The IP addresses below appear under “C2” in the source. The domains belong to the report’s broader set of related attacks and should not all be treated as confirmed command servers for the same infection chain. For a comprehensive list of network indicators, refer to <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/d50422a9-d9de-4458-909b-526eb2d1d3f0/Kimsuky-Operation-GitPower-Uses-GitHub-to-Deliver-Malware-and-Steal-Data.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Checksum-Mode=ENABLED&X-Amz-Credential=ASIA2F3EMEYE43UXHWEA%2F20261013%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261013T073051Z&X-Amz-Expires=1228&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEM%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCa2SlmlFVfT7dmpRgJeJjndQHSYM4zjlYbnkULoPkKWgIgf%2Fjb4XPHkpLwbCmZMstUBoyVC%2FFkSYkgXoCD16YgO4sqiQUImP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDNsAxALYmBsjXZ%2BwGCrdBK9vVZlZoPpC6nY5sMqe7JgH1GyJEQCPTTylAvJIuH44eglewy2E6DePh6p58AkG%2FuSo8ucRJRdYPmMSDu%2F8dZ1CutDKsLVfAsbfWEoCMcdM3Z8gfZL9wTaEL5ULAs4XZlqy%2FX8sejlo4ilCD7SbOHQuZKjmb8c2vOwYGymwVmjuVB7HIu%2B1CixnPymcRUvoIHIuAMx3hoXviZATBTPf4A2CcQ%2BBHHn61NJwy1Qh3urrV2FGgQH4VcLUpskv%2FcK1%2B81q1qCNvur2v8GI%2F3PSjuA2pN3C7XZJ1TqEVk%2FrFb8Q%2Bh8F

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.