DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering XenoRAT via GitHub-based C2 Targeting South Korea
DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering (TL-2026-0771), also tracked as DPRK LNK GitHub C2 Campaign, is a high-severity malware campaign, first published 2026-06-10 and last reviewed 2026-08-06. It is attributed to Kimsuky (North Korea) with medium confidence, affects Microsoft Windows, maps to 20 MITRE ATT&CK techniques (T1027, T1036, T1037), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0771
- Threat ID
- TL-2026-0771
- Also known as
- DPRK LNK GitHub C2 Campaign, motoralis GitHub C2 Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-08-06
- Attribution
- Kimsuky
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government, diplomatic, financial, cryptocurrency, technology, think-tanks
- Target regions
- South Korea, East Asia
- Detection rules
- 9
- Indicators of compromise
- 25
- Updates
- 2026-08-06
Malware and tooling in DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering
Malware and tooling: MoonPeak, XenoRAT
FortiGuard Labs documented an active North Korean (Kimsuky-attributed) campaign that delivers obfuscated Windows LNK files disguised as Korean PDF proposals, which drop a decoy PDF and run hidden, obfuscated PowerShell to deploy XenoRAT. The operation abuses GitHub (raw.githubusercontent.com + the GitHub REST API with hard-coded personal access tokens) as command-and-control and exfiltration infrastructure, blending into trusted developer traffic to evade detection.
How DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering works
FortiGuard Labs identified a series of malicious Windows shortcut (LNK) files targeting users and organizations in South Korea as part of an ongoing DPRK state-sponsored espionage campaign attributed to Kimsuky, with TTP overlaps to APT37/ScarCruft and broader Lazarus-pattern activity. The LNK files masquerade as Korean-language business and diplomatic PDF documents (e.g. strategic partnership proposals, investment fund offers, and an 'Urgent Letter from the Ambassador, Embassy of Poland'), using the .pdf.lnk double-extension and 'Hangul Document' naming patterns characteristic of North Korean operators.
When executed, the LNK opens a decoy PDF to allay suspicion while silently launching an obfuscated PowerShell payload. The PowerShell stage performs anti-analysis reconnaissance, enumerating running processes for virtual-machine artifacts (vmtoolsd, vboxservice), debuggers and reverse-engineering tools (x64dbg, OllyDbg, IDA, dnSpy, de4dot, ImmunityDebugger), and network/forensic analysis utilities (Wireshark, Fiddler, Procmon, ProcessHacker, TCPView); if any are present, execution terminates immediately. Surviving hosts have a VBScript dropped and registered as a scheduled task (using decoy names such as 'Technical Paper for Creata Chain Task...' and 'SysUpdate') that re-launches the PowerShell payload in a hidden window every 30 minutes via wscript.exe, providing persistence across reboots.
The campaign's defining innovation is the use of GitHub as C2. The malware authenticates to the GitHub REST API with hard-coded personal access tokens and pulls additional staged payloads and operator instructions from attacker-controlled repositories (notably the 'motoralis/singled' repo, e.g. raw.githubusercontent.com/motoralis/singled/main/kcca/paper.jim and api.github.com/repos/motoralis/singled/contents/kcca/technik), while uploading exfiltrated host profiles and beacon logs back to the repo (e.g. jjyun/network/<Date>_<Time>-<IP>-Real.log). Multiple sock-puppet GitHub accounts (motoralis, God0808RAMA, Pigresy80, entire73, pandora0009, brandonleeodd93-blip) support the operation. The final payload is XenoRAT (open-source .NET RAT), consistent with prior Kimsuky GitHub-C2 deployments of XenoRAT and its MoonPeak variant documented by ENKI and Trellix in 2025. The actor's heavy reliance on living-off-the-land binaries (LOLBins) and a legitimate cloud service for C2 yields a low detection footprint, making behavioral and network-egress detection essential for defenders.
MITRE ATT&CK techniques used in TL-2026-0771
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Persistence
T1037 Boot or Logon Initialization Scripts; T1547 Boot or Logon Autostart Execution
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer
Initial Access
Affected products and versions in DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022
Remediation for DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering
Immediate actions
- Block outbound access to raw.githubusercontent.com and api.github.com from endpoints that have no developer business need; alert on GitHub API calls from non-developer hosts
- Hunt for and remove scheduled tasks that launch wscript.exe/powershell.exe in a hidden window on a 30-minute interval (decoy names e.g. 'SysUpdate', 'Technical Paper for Creata Chain Task...')
- Quarantine the five+ known LNK SHA256 hashes and the XenoRAT RTF payloads at mail gateway and EDR
- Search email gateways for .pdf.lnk double-extension attachments and Korean-language proposal lures
Workarounds
- Configure Windows to open .lnk and .url files with a non-executing handler or block them at the mail gateway
- Apply ASR rules blocking executable content from email/webmail and blocking Office/script-host child process creation
Longer-term hardening
- Deploy EDR with behavioral detection for LNK->PowerShell->scheduled-task chains and LOLBin abuse (wscript.exe spawning PowerShell)
- Enforce GitHub allow-listing / egress proxy inspection so cloud-service C2 cannot blend with legitimate traffic
- Disable or constrain Windows Script Host (wscript.exe/cscript.exe) where not required
- Enable PowerShell script-block and module logging plus AMSI to capture obfuscated/encoded payloads
Weaknesses (CWE) in DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering
CWE-506
Timeline of DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering
- XenoRAT is published as a free, open-source .NET remote access trojan on GitHub (developer moom825); it is later adopted and customized by DPRK operators, including Kimsuky, for espionage operations.
- Earliest XenoRAT-delivering LNK variants in this cluster traced to 2024; early versions had minimal obfuscation and retained significant metadata, enabling tracking of related attacks.
- Cisco Talos documents the DPRK-linked 'UAT-5394' actor deploying MoonPeak, a XenoRAT-derived RAT, from attacker-controlled cloud infrastructure — establishing the malware lineage later operated with GitHub C2.
- ENKI and Trellix document Kimsuky abusing GitHub as C2 to deliver XenoRAT and its MoonPeak variant ('Coordinated Embassy Hunt' DPRK GitHub C2 espionage campaign).
- Operator GitHub accounts (motoralis, God0808RAMA, Pigresy80, entire73, pandora0009, brandonleeodd93-blip) established/used for staging payloads and uploading exfiltrated host logs.
- Threat actor evolves TTPs: embeds decoding functions within LNK arguments and includes encoded payloads directly inside the LNK files, increasing obfuscation.
- Recent surge in motoralis GitHub account activity observed alongside a wave of Korean-language proposal and diplomatic (Embassy of Poland) LNK lures.
- FortiGuard Labs publishes 'DPRK-Related Campaigns with LNK and GitHub C2', detailing the multi-stage LNK->PowerShell->XenoRAT chain and GitHub C2; detection LNK/Agent.ALN!tr.
- Multiple outlets (The Hacker News, CSO Online, GBHackers, TechNadu) amplify the FortiGuard findings, highlighting GitHub-as-C2 abuse and hard-coded personal-access-token authentication against South Korean targets.
- SOC Prime and other vendors publish detection content and SIEM rules mapping the campaign to MITRE ATT&CK.
Update history for TL-2026-0771
- 2026-08-06 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 62 community-related indicator(s).
Sources cited for DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering
- DPRK-Related Campaigns with LNK and GitHub C2
- DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea
- The Coordinated Embassy Hunt: Unmasking the DPRK-linked GitHub C2 Espionage Campaign
- DPRK-Related Campaigns with LNK and GitHub C2 (Detection Content)
- North Korean hackers abuse LNKs and GitHub repos in ongoing campaign
- North Korea Uses GitHub as C2 in New LNK Phishing Campaign
- DPRK Phishing Campaigns Exploit GitHub C2 Infrastructure
- DPRK-Related Campaigns with LNK and GitHub C2 - Threat Radar
Threats related to DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering
Detection coverage for TL-2026-0771
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0771 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.