Threat reportAPTTL-2026-3379
Kimsuky 'Operation GitPower': Fake Zoom Installers and Malicious LNK Files Deliver Malware via GitHub/GitLab Staging
Kimsuky 'Operation GitPower' (TL-2026-3379), also tracked as Operation GitPower, is a high-severity advanced persistent threat campaign, first published 2026-10-13. It is attributed to Kimsuky (North Korea) with medium confidence, affects Microsoft Windows, maps to 26 MITRE ATT&CK techniques (T1027, T1036.004, T1036.005), and is covered by 9 detection rules and 40 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 26MITRE ATT&CK
- Actors
- 1Kimsuky
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 40Indicators of compromise
Key facts for TL-2026-3379
- Threat ID
- TL-2026-3379
- Also known as
- Operation GitPower
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Kimsuky
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government administration, diplomacy, it - security, international policy, civil society, think tanks
- Target regions
- ukraine, south korea, japan
- Detection rules
- 9
- Indicators of compromise
- 40
- Updates
- 2026-10-13 · revalidated 1× · latest source
Malware and tooling in Kimsuky 'Operation GitPower'
Malware and tooling: Systeminfo - S0096, cmd - S0106
How Kimsuky 'Operation GitPower' works
North Korea-linked Kimsuky uses reply-baiting spear phishing with double-extension LNK attachments and a fake Zoom installer (zoominstaller.exe) to deploy VBScript/PowerShell payloads staged on GitHub/GitLab. Victims are Ukrainian experts in diplomacy, security and international policy; persistence is via scheduled tasks and data is exfiltrated via the GitHub Contents API.
Genians Security Center reports a Kimsuky campaign (tracked as Operation GitPower) targeting Ukrainian experts in diplomacy, security and international policy, as well as Ukrainian civil-society officials working on war recovery, with secondary targeting of Japanese-language speakers and South Korean North Korea-affairs experts. Genians assesses the objective as cyber espionage: collecting information on the war, North Korean troop losses, the handling of prisoners of war, and South Korea-Ukraine consultations.
Initial access is by reply-baiting spear phishing sent from Gmail/Proton Mail accounts. The first message impersonates a conference organizer (for example the Korea Cyber Security Conference, KCSCON) and contains legitimate event details but no attachment or link. Only after the victim replies does the actor send a (later password-protected) ZIP archive containing an HTML decoy and a malicious LNK disguised as a PDF with a double extension, such as KCSCON_2026_Official_Invitation.pdf.lnk. A separate variant distributes a trojanized fake Zoom installer (zoominstaller.exe) that embeds desktop.ps1 and desktop.vbs; Genians linked a phishing domain, security-zooma.serveirc.com, to 85.155.224.59.
Opening the LNK launches cmd.exe, which uses curl -k -L to fetch a decoy PDF (kcs.pdf, aaa.pdf) and a loader saved as first.ini and executed as a VBE through wscript.exe. Hidden PowerShell (-ep bypass, -WindowStyle Hidden) reconstructs code with string-replacement obfuscation (inserted tokens such as apple, wolf and wudks removed with .Replace()). Staged files on GitHub are disguised as LICENSE (VBScript, update1.vbs) and okay.md (PowerShell, update2.ps1); GitLab repositories (galata20/shiba, kickball12/bahubali, keresman) hold first.ini, help.ini and decoys. Codeberg was used to distribute archives.
Persistence uses scheduled tasks with names imitating legitimate software - GoogleUpdateTaskMachineUA{...}, OneDriveUpdateScheduler and Zoom-Auto-Installer (wscript.exe, every minute) - running every 1, 15 or 30 minutes. The malware collects systeminfo output and a listing of the Downloads folder into SYS_<timestamp>.tmp and DOWN_<timestamp>.tmp files, Base64-encodes them and uploads them through the GitHub Contents API with a hard-coded Bearer access token, then removes traces. A TCP backdoor channel on 111.92.246.145:12345 serves qqq*.ps1 task scripts in response to 'GET qqq' requests and receives ddd*.txt output. Web-based loaders on free-hosting domains (medianewsonline.com, mygamesonline.org, mywebcommunity.org, dothome.co.kr) are also used.
Genians attributes the activity to Kimsuky based on reuse of first.ini/help.ini names and structure from earlier GitPower activity, the 'wolf' string-obfuscation artifact, identical GitHub Contents API implementation, GoogleUpdateTaskMachineUA task naming, overlapping free-hosting infrastructure, and Korean-language mail services (Kakao/Daum) in commit metadata. Separate Genians reporting on Kimsuky GitHub/GitLab activity describes LNK lures delivering encrypted AsyncRAT payloads and decoy PDFs generated with the opencode AI agent; those reports describe related but distinct activity. Only the GBHackers article and Genians findings summarized via fetch were reviewed; the 99+ additional MD5 hashes in the original report were not retrievable. BeaconBeagle returned no record (HTTP 404) for 45.150.109.102.
MITRE ATT&CK techniques used in TL-2026-3379
Defense Evasion
T1027 Obfuscated Files or Information; T1036.004 Masquerading: Masquerade Task or Service; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1036.007 Masquerading: Double File Extension; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File
Collection
T1074.001 Data Staged: Local Data Staging
Command and Control
T1095 Non-Application Layer Protocol; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1132.001 Data Encoding: Standard Encoding
Initial Access
T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link
Exfiltration
T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1585.002 Establish Accounts: Email Accounts
Affected products and versions in Kimsuky 'Operation GitPower'
- Microsoft — Windows
Vulnerable versions: Windows endpoints that execute LNK, VBE and PowerShell payloads
Remediation for Kimsuky 'Operation GitPower'
Immediate actions
- Block the C2 IPs and phishing/loader domains listed in the IOCs at the perimeter and DNS
- Hunt for scheduled tasks named OneDriveUpdateScheduler, Zoom-Auto-Installer and GoogleUpdateTaskMachineUA* that launch wscript.exe or powershell.exe
- Hunt for LNK files with double extensions (.pdf.lnk) spawning cmd.exe, curl, powershell.exe or wscript.exe
- Revoke and rotate any GitHub/GitLab tokens found on affected hosts and review outbound api.github.com Contents API use from non-developer endpoints
Workarounds
- Only download Zoom from the official zoom.us site; treat zoominstaller.exe received by email or from third-party links as malicious
Longer-term hardening
- Block or alert on execution of LNK files from ZIP archives and user-writable paths
- Restrict access to GitHub, GitLab and Codeberg from endpoints that have no business need
- Train high-risk staff (policy, diplomacy, security researchers) on reply-baiting phishing and unsolicited conference invitations
- Enable PowerShell script block logging and constrain wscript.exe/cscript.exe execution of .vbe files
Timeline of Kimsuky 'Operation GitPower'
- Earlier spear phishing against Ukrainian government agencies reported by Proofpoint (February 2025); Genians cites code reuse with earlier GitPower activity.
- KCSCON speaker-invitation reply-baiting attacks begin.
- Genians begins collecting 13 malicious LNK files (collected Aug 11-19, 2026) with financial/corporate-themed filenames.
- Analytical-collaboration lure sent to a Ukrainian international policy expert (aaa.pdf decoy).
- GitLab repository 'shiba' created, hosting first.ini and help.ini for Ukraine-targeted attacks.
- The genuine Korea Cyber Security Conference takes place; the impersonated event had been used as a lure.
- GitLab repository 'keresman' created, containing Japanese-language decoy PDFs.
- Updated variants observed using password-protected archives (reported as September 2026).
- Genians publishes its Operation GitPower analysis with IOCs.
- GBHackers publishes coverage of the Genians Operation GitPower report.
Update history for TL-2026-3379
- 2026-10-13 — Kimsuky Operation GitPower Uses GitHub, GitLab and Codeberg to Deliver Malware and Steal Data: What changed No field escalation: severity HIGH, exploitability ACTIVE, status ACTIVE and attribution confidence MEDIUM are already at the levels the new report supports. New indicators (15) 15 new indicators: 4 domains (argentinese.mediane
Sources cited for Kimsuky 'Operation GitPower'
Detection coverage for TL-2026-3379
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3379 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3379
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.