# DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering XenoRAT via GitHub-based C2 Targeting South Korea

> FortiGuard Labs documented an active North Korean (Kimsuky-attributed) campaign that delivers obfuscated Windows LNK files disguised as Korean PDF proposals, which drop a decoy PDF and run hidden, obfuscated PowerShell to deploy XenoRAT. The operation abuses GitHub (raw.githubusercontent.com + the GitHub REST API with hard-coded personal access tokens) as command-and-control and exfiltration infrastructure, blending into trusted developer traffic to evade detection.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-08-06T18:51:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0771
- **ID:** TL-2026-0771
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiGuard Labs identified a series of malicious Windows shortcut (LNK) files targeting users and organizations in South Korea as part of an ongoing DPRK state-sponsored espionage campaign attributed to Kimsuky, with TTP overlaps to APT37/ScarCruft and broader Lazarus-pattern activity. The LNK files masquerade as Korean-language business and diplomatic PDF documents (e.g. strategic partnership proposals, investment fund offers, and an 'Urgent Letter from the Ambassador, Embassy of Poland'), using the .pdf.lnk double-extension and 'Hangul Document' naming patterns characteristic of North Korean operators.

When executed, the LNK opens a decoy PDF to allay suspicion while silently launching an obfuscated PowerShell payload. The PowerShell stage performs anti-analysis reconnaissance, enumerating running processes for virtual-machine artifacts (vmtoolsd, vboxservice), debuggers and reverse-engineering tools (x64dbg, OllyDbg, IDA, dnSpy, de4dot, ImmunityDebugger), and network/forensic analysis utilities (Wireshark, Fiddler, Procmon, ProcessHacker, TCPView); if any are present, execution terminates immediately. Surviving hosts have a VBScript dropped and registered as a scheduled task (using decoy names such as 'Technical Paper for Creata Chain Task...' and 'SysUpdate') that re-launches the PowerShell payload in a hidden window every 30 minutes via wscript.exe, providing persistence across reboots.

The campaign's defining innovation is the use of GitHub as C2. The malware authenticates to the GitHub REST API with hard-coded personal access tokens and pulls additional staged payloads and operator instructions from attacker-controlled repositories (notably the 'motoralis/singled' repo, e.g. raw.githubusercontent.com/motoralis/singled/main/kcca/paper.jim and api.github.com/repos/motoralis/singled/contents/kcca/technik), while uploading exfiltrated host profiles and beacon logs back to the repo (e.g. jjyun/network/<Date>_<Time>-<IP>-Real.log). Multiple sock-puppet GitHub accounts (motoralis, God0808RAMA, Pigresy80, entire73, pandora0009, brandonleeodd93-blip) support the operation. The final payload is XenoRAT (open-source .NET RAT), consistent with prior Kimsuky GitHub-C2 deployments of XenoRAT and its MoonPeak variant documented by ENKI and Trellix in 2025. The actor's heavy reliance on living-off-the-land binaries (LOLBins) and a legitimate cloud service for C2 yields a low detection footprint, making behavioral and network-egress detection essential for defenders.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1037 Boot or Logon Initialization Scripts
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1564 Hide Artifacts
- T1218 System Binary Proxy Execution
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1102 Web Service
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [DPRK-Related Campaigns with LNK and GitHub C2](https://www.fortinet.com/blog/threat-research/dprk-related-campaigns-with-lnk-and-github-c2)
- [DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea](https://thehackernews.com/2026/04/dprk-linked-hackers-use-github-as-c2-in.html)
- [The Coordinated Embassy Hunt: Unmasking the DPRK-linked GitHub C2 Espionage Campaign](https://www.trellix.com/blogs/research/dprk-linked-github-c2-espionage-campaign/)
- [DPRK-Related Campaigns with LNK and GitHub C2 (Detection Content)](https://socprime.com/active-threats/dprk-related-campaigns-with-lnk-and-github-c2/)
- [North Korean hackers abuse LNKs and GitHub repos in ongoing campaign](https://www.csoonline.com/article/4154471/north-korean-hackers-abuse-lnks-and-github-repos-in-ongoing-campaign.html)
- [North Korea Uses GitHub as C2 in New LNK Phishing Campaign](https://gbhackers.com/lnk-phishing-campaign/)
- [DPRK Phishing Campaigns Exploit GitHub C2 Infrastructure](https://www.technadu.com/dprk-phishing-campaigns-exploit-github-c2-to-target-users-in-south-korea/625004/)
- [DPRK-Related Campaigns with LNK and GitHub C2 - Threat Radar](https://radar.offseq.com/threat/dprk-related-campaigns-with-lnk-and-github-c2-91573c21)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0771