Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data

Kimsuky is using GitHub and other trusted code platforms to deliver malware, run commands, and steal data from Ukrainian experts in diplomacy, security, and international policy.

The North Korea-linked group’s Operation GitPower combines targeted emails, fake PDF files, and Windows scripts to turn routine work requests into possible entry points for cyber spying.

The attacks use conference invitations and research requests to build trust before sending harmful files. Codeberg hosts malicious archives, GitLab supplies decoy documents and scripts, and GitHub supports payload delivery and data transfers.

Most observed attempts against the Ukrainian targets were unsuccessful, an important limit on the campaign’s reported impact.

Researchers from Genians identified the activity in an October 12, 2026 report, linking it to earlier Operation GitPower attacks through shared code, file names, scheduled tasks, and methods used to upload stolen information. Their findings show how the group changes its email themes while keeping much of its attack framework.

Kimsuky Operation GitPower

One attack began on August 6 with a fake speaking invitation to the Korea Cyber Security Conference. The email used real event details, praised the recipient’s work, and offered travel support and payment.

Unlike earlier Kimsuky GitHub attacks that delivered malicious shortcuts, this case started with a message containing no harmful link or attachment.

Only after a target replied did the attacker send a ZIP archive with invitation materials. A later version used password protection, which researchers assessed as an effort to make inspection harder for email security tools.

Inside, a genuine-looking HTML invitation helped hide a Windows shortcut dressed up as a PDF. A separate approach on August 19 impersonated a policy researcher seeking feedback on a report about Russia and North Korea.

After receiving a reply, the attacker sent a Codeberg download link. When the malware attempt failed, a September follow-up switched to a fake meeting login page designed to steal account details.

Opening the malicious shortcut starts cmd.exe and uses curl to download files from GitLab. Depending on the version, a decoy PDF opens while another download is saved as a VBE script and runs in the background. The initial script retrieves a follow-up component that executes in memory.

The loader hides PowerShell commands by inserting extra words, then removes them with Replace() just before execution.

The follow-up script creates a task that looks like a Google update and runs every 15 minutes. It collects systeminfo output and a listing of the user’s Downloads folder, rather than automatically stealing every file there.

GitHub Malware Delivery and Data Theft

Collected information is encoded in Base64 and uploaded through the GitHub Contents API using a hardcoded access token. Temporary files and the initial script are then deleted.

Similar use of GitHub and recurring tasks appeared in Kimsuky AI phishing campaigns covered previously, although those earlier findings included AsyncRAT payloads not established for this Ukrainian attack chain.

Other September samples used peace-report and researcher résumé themes. Their shortcuts downloaded files named LICENSE and okay.md from GitHub, but these contained VBScript and PowerShell code.

A OneDrive-themed task ran every minute, allowing a separate control server to deliver more scripts and receive files created during their execution.

The group also placed an unsigned, 64-bit fake Zoom installer in a public GitHub repository. It drops hidden scripts, creates a task that runs every minute, and contacts the same control server used by the September shortcut samples.

It then downloads and starts the real Zoom installer, giving users a familiar installation screen after malware is already present.

The wider operation has also featured Kimsuky OpenCode phishing decoys in earlier research, showing how lure production can change without replacing the core script-based approach.

Genians linked the Ukrainian activity to Kimsuky through combined technical evidence, not simply the use of GitHub or the subject of an email.

Genians assesses that the targeting may support spying on the war and ongoing cooperation between South Korea and Ukraine.

Japanese decoy documents found in related repositories also suggest possible interest in Japanese speakers, but do not confirm successful attacks. The report does not establish that every file stored in those repositories reached an intended victim.

For defenders, the report recommends linking endpoint events rather than blocking every development platform. A shortcut launching cmd.exe, curl, or hidden PowerShell should be reviewed alongside new scripts, update-themed tasks, GitHub API uploads, and unusual network connections.

Installer checks should include digital signatures and background activity, since a real setup screen does not prove that the file launching it is safe.

Indicators of compromise (IoCs):-

File Hashes

All hashes in this table are MD5 values published in the source’s IoC section.

Type	Published indicators
MD5	05cec01db363488e6762097095d7b7fc 05e65662d55327febf5d4aaeca54f982 0919c2a84a1c76d6f5268dd5ffd7b5e7 0933fda33f46d2b31e023bf322a11d41 0a0fe8a557eff10b3b32528347b9d988
MD5	0ae92755dafc510efdc9f68e817b683a 0c89cc9118b863488f5ba240bfe396f6 14c8b93304700e27b479596024ef19cf 1f5416894b604ed6ef1f839414865eee 1f873bc5c6d5ff0ae0f228dbf26220ba
MD5	1f8ad760e1feee7cecfe1bfadde93d4e 2062dde8114d57b0108e92371e29b3ed 2364f22dfe4d2018619cfba2b510f290 24b12630d402e4ce40d05e0623e56933 26642b9800192440621a70383595dea2
MD5	28210832c13d806e87cb8f1449cf8c5f 28fb9e179c3aac449b7e4d760f6b8b7d 2a100b8de6099b06449e3084b689c32d 2e36880877f32eac56ae4502ad057b2e 2f407d8e3dee54e0c4f776e5db55ae86
MD5	324352a61a343969a93386466d232684 337edcca9ef27cfe1a76f4cffa676026 33cd80a0b3059c23eadcf263ddbb330f 348150ce9f3c49283c16d9b37e6dc354 353311ea9b82724aa862477cae44cd39
MD5	380d5a157077b7c8bdfe7c6d9628fe6d 382bb72f7f42f27b04d1fedd6d633a82 3d3f6897f57f4a7b94f83278e795dc18 40b48810400a825858946aae9ff5b50d 4f5694f61b4c244cc2269c3a5eb8a7c7
MD5	5282b7aa97f45feeff73ba87d0523e53 567a2aedd00fa97f03fc852b1d949596 57025a7f9d9d2ef4930dec189bdd0bd0 5a0923427b2fcb5070510753e4f0c0d0 5dd387acef74a14a63dbc883aadee854
MD5	5fa367e38148de7e19abe789451a7a38 620bc65bb86962f633a37586e17da9f3 6896f9c3f24f2fdc7966f753ad3ce723 76ed1e64d1c9ea3e4b91f7ed7b2f59f2 77b9a8309e9f80ca442c629396cc3f6e
MD5	78bf053eea23b86e42a658245d8de904 7a6e1e578342864c1bb07c83b4e677e3 7e76b71247c995359a7642fe62f3b28f 7f1b4583fec9db44e85b458df4e55669 8445ffdacfed1fc9951e62ea054ee1c3
MD5	85fcd85d24e1b391cbf0c22b0c8a362a 896a859812f181286542a0041a549156 8d73beff15a0467b9bc2b74f6abed75d 90449413823f31c89f2bd12b5a1ae5d5 93587de64c445e7fe20351f24c4a97d4
MD5	9b33a10f7637c7ce9e5e8aa1ed7303dd 9c2d0cace5c703afa9f3862d19073c6d 9d3b0832e1759d29d2651f3a2d34d781 9f14d0c51795489bbb8d1853fb7e269d a0f8c686d57c746bcd97e21dc8fa2159
MD5	a49a2676174f1d7c5e8647e4fc7316de a80dd39ce35e712fde43b51f6a5ac22a a86861abef9de0148a560614a5830a19 ae2a710e1940b5a7c3d8c7da754a4bdc ae2fb368e8f33de4b5382dc3296c7076
MD5	b52d4d43ddbd8a2b34808e45bd1d4504 b64e08e12d90ee33c4409204a1ea509b b65049b275769947fce9d332de39ad58 b7db9fe60ce4a2372ee7d4665ae859ba bc903979c2ef367f15424d651eb1730d
MD5	bf95687e8f040d9b656e2702eca30ff6 bfb0591fb5c58b5ef751c9994cb86fbd c6017291b89dc20b4b333b6e5d1e92c2 ca3e297df21d63fabbcac343dd2740c9 d915752f0dfe5d2ca3388cc711840d31
MD5	d9ebfcce15a1a2c39c22aea092d6fb11 da44fa987f5a1967b8691254419d8e52 dc5a698e0f74b79da77592145a669f51 dcbb6683e1f5c826d0f65dc68999fe52 e5b1e7b3f3ab24239f2cd1cbce806228
MD5	ea02654da967a66ba0bda85f8578562a eb9d0c1e252a2b08ddfdeb7dc458032a ed02d851d07f38d9bb04a0d2e464cf10 f547cad15814b06c7876c63609da5b8f f549fc826acf79521d6a0c8aa63095e0
MD5	f5f5da0dac34841451c5328871d0d77b f6786ff62fdfdc46cfb84ff7cc2a580a f6f00417b925bf42090a89f8668fb554 f85016e8cc6b509a9fba1ccd1dc88da1 fa87911771a52e3c1ffb1c39da59540c

Network Indicators

The IP addresses below appear under “C2” in the source. The domains belong to the report’s broader set of related attacks and should not all be treated as confirmed command servers for the same infection chain.

Type	Published indicators
C2 IP addresses	45.150.109[.]102 85.155.224[.]59 103.153.65[.]67 111.92.246[.]145 169.197.85[.]174 195.250.24[.]113
Domains	argeninese.dothome.co[.]kr argentinese.medianewsonline[.]com bbcnews04.dothome.co[.]kr bwer5t6kl.getenjoyment[.]net cfr556yujk.onlinewebshop[.]net
Domains	cmieqf7yjs.sportsontheweb[.]net d18i529.onlinewebshop[.]net dh06ls9kg.onlinewebshop[.]net dofamini.com[.]ua doput5rg.myartsonline[.]com
Domains	edcv89ik.onlinewebshop[.]net ej7ieb9bn.myartsonline[.]com ezms1ez.mygamesonline[.]org fo27axr8z.getenjoyment[.]net fqw345rdxc.onlinewebshop[.]net
Domains	gp098ujm.scienceontheweb[.]net gstcg9g.mywebcommunity[.]org gy678ikjm.onlinewebshop[.]net h4s7hlkpo.getenjoyment[.]net hcdse34r.onlinewebshop[.]net
Domains	hnvg5lco.mywebcommunity[.]org idr45tgb.myartsonline[.]com jkio954rt.medianewsonline[.]com jklo8yghj.scienceontheweb[.]net ke45tyghnj.mygamesonline[.]org
Domains	ki876tgvb.mypressonline[.]com kovalenko.dothome.co[.]kr mailsecurity.serveirc[.]com mf3goke.getenjoyment[.]net minecrafter.mygamesonline[.]org
Domains	msx2z9wy9.onlinewebshop[.]net mykolapalinchak.medianewsonline[.]com nimdm8cx87.mygamesonline[.]org ny6r3kijc.mypressonline[.]com oh8e6hd7ip.getenjoyment[.]net
Domains	oy51g1vt.getenjoyment[.]net oz9ffohqb.mywebcommunity[.]org p1o2i3u4y5t6r7e8w9q0.medianewsonline[.]com pokijhgcfsdfghnj.mywebcommunity[.]org qvck223mxo9.onlinewebshop[.]net
Domains	qweasdzxc.mygamesonline[.]org rty789ijnh.medianewsonline[.]com sclmu1lnils.scienceontheweb[.]net se4567yuhn.sportsontheweb[.]net security-zooma.serveirc[.]com
Domains	security-profile.serveirc[.]com svpiwsw.mypressonline[.]com t1b2a3vy.onlinewebshop[.]net tgg7ujhn.myartsonline[.]com vyt01cq8o1.atwebpages[.]com
Domains	w346yjkiu.onlinewebshop[.]net w50dleqwo0d.getenjoyment[.]net wersdfxcv.mygamesonline[.]org xv57j3d.scienceontheweb[.]net yrfghjk652u.mygamesonline[.]org
Domains	yyjybdrq4.scienceontheweb[.]net zvwb1ep7i.onlinewebshop[.]net

Email Indicators

These addresses are reproduced from the source’s formal email IoC list. Their inclusion does not mean each address performed the same role in every attack.

Type	Published indicators
Email addresses	babiest26@outlook[.]com baras6600@daum[.]net baras6600@hotmail[.]com baras6600@proton[.]me choemiyang@hotmail[.]com
Email addresses	davidmaximy@outlook[.]com davidmaximy@proton[.]me dustinharrise91@outlook[.]com hazama09093@outlook[.]com info.seclab.noreply@gmail[.]com
Email addresses	jamejacky55@proton[.]me jamestony88@proton[.]me jamjack2026@proton[.]me jsykukbang18@kakao[.]com kcscon@proton[.]me
Email addresses	ken0723@kakao[.]com killer05121@outlook[.]com leomsoite@gmail[.]com montry111@proton[.]me murayamasi26@outlook[.]com
Email addresses	nemotom@outlook[.]kr omski00@outlook[.]com payuser2026@outlook[.]com pooh04211@outlook[.]com skmotern2003@outlook[.]com
Email addresses	srahnn21@gmail[.]com sven5500@outlook[.]com sven5500@proton[.]me taini7700@daum[.]net taini7700@outlook[.]com
Email addresses	taini7700@proton[.]me urusa4400@proton[.]me void0824@proton[.]me xufeng.wangsui@hotmail[.]com yaosiyaosi26@hotmail[.]com
Email addresses	youth3920@outlook[.]com zhejiong.hangjou@hotmail[.]com

Additional Source-Reported Hunting Indicators

These technical artifacts come from the report’s analysis sections. Filenames, paths, and task names should be matched with suspicious execution or network activity, not treated as proof of compromise on their own.

Indicator type	Source-reported value	Role or context

Indicator type	Source-reported value	Role or context
GitLab repository paths	kickball12/bahubali galata20/shiba	Shared delivery infrastructure in the conference and research-report attacks.
Related GitLab repository	keresman	Contained Japanese decoy material and related scripts.
GitHub raw-content repository path	raw.githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh	Hosted the September shortcut payloads.
Conference archives	KCSCON_2026_Official_Invitation.zip KCSCON_Official Invitation Letter.zip	Follow-up phishing attachments.
Conference shortcut files	KCSCON_2026_Official_Invitation.pdf.lnk KCSCON_Official Invitation Letter_en.pdf.lnk	Malicious shortcuts disguised as PDF invitations.
Conference decoy files	KCSCON_2026_Official_Invitation.html kcs.pdf	Invitation content used to reduce suspicion.
Research-report shortcuts	Аналітичний_звіт_Наталії.pdf.lnk Natalia B*******_Analytic.pdf.lnk	Ukrainian and English report-themed variants; the source masks part of a person’s name.
September shortcuts	A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf.lnk CV_SocialResearcher_Sociologist_Qualitative.lnk	Peace-report and researcher CV lures.
Initial and follow-up scripts	first.ini help.ini	Disguised script components used for loading, collection, upload, and persistence.
Local VBE paths	C:UsersPublicMusicapple.vbe C:UsersPublicMusicshiba.vbe C:UsersPublicMusicshibaa.vbe	Downloaded or modified scripts used in the GitLab delivery chain.
Decoy PDF paths	C:UsersPublicMusickcs.pdf C:UsersPublicMusicaa.pdf	Locally saved decoy documents.
Google-themed scheduled task	GoogleUpdateTaskMachineUA{1C791230-CA8D-6D04-AC55-E498ABE7C33}	Runs the modified VBE script every 15 minutes.
Uploaded filename patterns	SYS_yyyy-MM-dd_HHmm.tmp DOWN_yyyy-MM-dd_HHmm.tmp	System information and Downloads-folder listings uploaded to GitHub.
GitHub payload filenames	LICENSE okay.md	VBScript and PowerShell disguised as ordinary repository files.
AppData payload paths	%APPDATA%update1.vbs %APPDATA%update2.ps1	September persistence and remote-task components.
OneDrive-themed scheduled task	OneDriveUpdateScheduler	Repeats execution every minute.
TCP control endpoint	111.92.246[.]145:12345	Receives connections from the September PowerShell payload and fake Zoom installer payload.
Embedded authentication string	MySecurePass123	Plaintext password reported in the fake Zoom installer’s PowerShell component.
Remote task filename patterns	qqq*.ps1 ddd*.txt	Additional PowerShell scripts and task files requested from the control server.
Decoy PDF URL	kovalenko.dothome.co[.]kr/media/A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf	Peace-report decoy.
Decoy PDF URL	dofamini.com[.]ua/media/CV_SocialResearcher_Sociologist_Qualitative.pdf	Researcher CV decoy.
Auxiliary loader endpoint	p1o2i3u4y5t6r7e8w9q0.medianewsonline[.]com/login.php	Loader found in README.md; the report did not establish its execution in the analyzed September shortcut chain.
Fake installer filename	zoominstaller.exe	Unsigned malicious executable hosted in a separate GitHub repository.
Fake installer payload paths	C:UsersPublicVideosdesktop.ps1 C:UsersPublicVideosdesktop.vbs	Scripts dropped by the malicious installer.
Zoom-themed scheduled task	Zoom-Auto-Installer	Runs the VBS payload through wscript.exe every minute.
Phishing domain and resolved IP	security-zooma.serveirc[.]com 85.155.224[.]59	Fake meeting login infrastructure observed during analysis.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data appeared first on Cyber Security News.