# Kimsuky 'Operation GitPower': Fake Zoom Installers and Malicious LNK Files Deliver Malware via GitHub/GitLab Staging

> North Korea-linked Kimsuky uses reply-baiting spear phishing with double-extension LNK attachments and a fake Zoom installer (zoominstaller.exe) to deploy VBScript/PowerShell payloads staged on GitHub/GitLab. Victims are Ukrainian experts in diplomacy, security and international policy; persistence is via scheduled tasks and data is exfiltrated via the GitHub Contents API.

- **Published:** 2026-10-13T06:11:39Z
- **Last reviewed:** 2026-10-13T08:34:51.980Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3379
- **ID:** TL-2026-3379
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Genians Security Center reports a Kimsuky campaign (tracked as Operation GitPower) targeting Ukrainian experts in diplomacy, security and international policy, as well as Ukrainian civil-society officials working on war recovery, with secondary targeting of Japanese-language speakers and South Korean North Korea-affairs experts. Genians assesses the objective as cyber espionage: collecting information on the war, North Korean troop losses, the handling of prisoners of war, and South Korea-Ukraine consultations.

Initial access is by reply-baiting spear phishing sent from Gmail/Proton Mail accounts. The first message impersonates a conference organizer (for example the Korea Cyber Security Conference, KCSCON) and contains legitimate event details but no attachment or link. Only after the victim replies does the actor send a (later password-protected) ZIP archive containing an HTML decoy and a malicious LNK disguised as a PDF with a double extension, such as KCSCON_2026_Official_Invitation.pdf.lnk. A separate variant distributes a trojanized fake Zoom installer (zoominstaller.exe) that embeds desktop.ps1 and desktop.vbs; Genians linked a phishing domain, security-zooma.serveirc.com, to 85.155.224.59.

Opening the LNK launches cmd.exe, which uses curl -k -L to fetch a decoy PDF (kcs.pdf, aaa.pdf) and a loader saved as first.ini and executed as a VBE through wscript.exe. Hidden PowerShell (-ep bypass, -WindowStyle Hidden) reconstructs code with string-replacement obfuscation (inserted tokens such as apple, wolf and wudks removed with .Replace()). Staged files on GitHub are disguised as LICENSE (VBScript, update1.vbs) and okay.md (PowerShell, update2.ps1); GitLab repositories (galata20/shiba, kickball12/bahubali, keresman) hold first.ini, help.ini and decoys. Codeberg was used to distribute archives.

Persistence uses scheduled tasks with names imitating legitimate software - GoogleUpdateTaskMachineUA{...}, OneDriveUpdateScheduler and Zoom-Auto-Installer (wscript.exe, every minute) - running every 1, 15 or 30 minutes. The malware collects systeminfo output and a listing of the Downloads folder into SYS_<timestamp>.tmp and DOWN_<timestamp>.tmp files, Base64-encodes them and uploads them through the GitHub Contents API with a hard-coded Bearer access token, then removes traces. A TCP backdoor channel on 111.92.246.145:12345 serves qqq*.ps1 task scripts in response to 'GET qqq' requests and receives ddd*.txt output. Web-based loaders on free-hosting domains (medianewsonline.com, mygamesonline.org, mywebcommunity.org, dothome.co.kr) are also used.

Genians attributes the activity to Kimsuky based on reuse of first.ini/help.ini names and structure from earlier GitPower activity, the 'wolf' string-obfuscation artifact, identical GitHub Contents API implementation, GoogleUpdateTaskMachineUA task naming, overlapping free-hosting infrastructure, and Korean-language mail services (Kakao/Daum) in commit metadata. Separate Genians reporting on Kimsuky GitHub/GitLab activity describes LNK lures delivering encrypted AsyncRAT payloads and decoy PDFs generated with the opencode AI agent; those reports describe related but distinct activity. Only the GBHackers article and Genians findings summarized via fetch were reviewed; the 99+ additional MD5 hashes in the original report were not retrievable. BeaconBeagle returned no record (HTTP 404) for 45.150.109.102.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1036.007 Masquerading: Double File Extension
- T1036.004 Masquerading: Masquerade Task or Service
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1082 System Information Discovery
- T1095 Non-Application Layer Protocol
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1583.006 Acquire Infrastructure: Web Services
- T1583.001 Acquire Infrastructure: Domains
- T1585.002 Establish Accounts: Email Accounts
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1074.001 Data Staged: Local Data Staging
- T1105 Ingress Tool Transfer
- T1102.002 Web Service: Bidirectional Communication
- T1132.001 Data Encoding: Standard Encoding

## Sources

- [Kimsuky Uses Fake Zoom Installers and Malicious LNK Files to Deploy Malware](https://gbhackers.com/fake-zoom-installers-exploited/)
- [Genians: Operation GitPower](https://www.genians.co.kr/en/blog/threat_intelligence/operation-gitpower)
- [Genians: Kimsuky AI/LLM-assisted attack operations](https://genians.co.kr/en/blog/threat_intelligence/kimsuky_ai_llm)
- [Genians: AI agent opencode used in Kimsuky campaign](https://genians.co.kr/en/blog/threat_intelligence/ai-agent-opencode)
- [Genians Finds Kimsuky Used OpenCode in GitHub PAT-Backed LNK Campaign](https://letsdatascience.com/news/genians-finds-kimsuky-used-opencode-in-github-pat-backed-lnk-8e1a123c)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3379