Kimsuky Operation GitPower Leverages GitHub for Malware Delivery and Data Exfiltration
North Korea-linked Kimsuky group's Operation GitPower uses GitHub, GitLab, and Codeberg to deliver malware and steal data from Ukrainian experts, employing spear-phishing and disguised malicious files.
The North Korea-aligned Kimsuky threat group has been observed employing a sophisticated campaign dubbed Operation GitPower, which strategically utilizes trusted code hosting platforms like GitHub, GitLab, and Codeberg to facilitate malware delivery and exfiltrate sensitive data. The primary targets of this operation are Ukrainian experts in diplomacy, security, and international policy. The campaign commences with highly targeted spear-phishing emails, often disguised as legitimate conference invitations or research requests, designed to build rapport and trust before introducing malicious payloads.
Researchers from Genians identified this activity, noting that while most observed attack attempts were unsuccessful, the campaign demonstrates Kimsuky's evolving tactics. The group adeptly modifies its email themes and lure documents while retaining a consistent underlying attack framework. One notable attack vector involved a fake speaking invitation to the Korea Cyber Security Conference, which, after initial engagement, led to the delivery of a password-protected ZIP archive containing seemingly innocuous invitation materials. This archive concealed a Windows shortcut file disguised as a PDF, a common tactic to bypass security scrutiny.
Another variant of the attack, initiated on August 19, impersonated a policy researcher seeking feedback on a report concerning Russia and North Korea. Following a reply from the target, the attacker provided a download link from Codeberg. When this initial malware attempt failed, a subsequent follow-up in September shifted to a fake meeting login page, aimed at harvesting user credentials.
The technical execution involves a chain of commands. Upon opening a malicious shortcut, the cmd.exe utility is invoked to download files from GitLab using curl. Depending on the specific malware variant, a decoy PDF document might be presented to the user, while another downloaded file, often a VBScript or PowerShell script, is saved and executed in the background. This initial script then fetches a more advanced component that operates entirely in memory, making it harder to detect.
To evade detection, the malware employs obfuscation techniques, such as hiding PowerShell commands by inserting extraneous words that are later removed just before execution using the Replace() function. A persistent threat is established through a scheduled task, disguised as a legitimate Google update, which runs every 15 minutes. This task is configured to collect system information and a listing of files within the user's Downloads folder, rather than indiscriminately exfiltrating all data.
Data exfiltration is achieved by encoding the collected information in Base64 and uploading it via GitHub's Contents API, utilizing a hardcoded access token. After the data transfer, temporary files and the initial malicious script are systematically deleted to minimize forensic traces. Similar patterns of GitHub usage and recurring scheduled tasks have been observed in previous Kimsuky AI phishing campaigns, although those campaigns sometimes included different payloads like AsyncRAT.
In some instances, the group has also distributed unsigned, 64-bit fake Zoom installers from public GitHub repositories. These installers drop hidden scripts, establish a minute-running scheduled task, and communicate with a control server to download and execute the legitimate Zoom installer, presenting a familiar installation interface to the user while malware operates in the background. Genians' analysis links this activity to Kimsuky through shared technical indicators, reinforcing the group's consistent methodology despite evolving lures.
The campaign's targeting of Ukrainian experts, coupled with the exfiltration of data related to the ongoing conflict and international policy, suggests a clear espionage objective. The presence of Japanese decoy documents in related repositories also indicates potential interest in Japanese-speaking targets. Defenders are advised to monitor endpoint events holistically, correlating suspicious activities such as shortcut launches, unusual script executions, GitHub API uploads, and unexpected network connections, rather than relying on blocking individual development platforms.