Kimsuky Uses GitHub Infrastructure for Operation GitPower Cyber Spying Campaign
North Korea-linked group targets Ukrainian policy experts with malware delivered via trusted code hosting platforms.
Key points
- Researchers identified Operation GitPower attacks targeting Ukrainian diplomats and security experts.
- The campaign uses GitHub, GitLab, and Codeberg to distribute malicious scripts and steal data.
- Most observed intrusion attempts against the targeted Ukrainian professionals were unsuccessful.
The North Korea-linked threat group Kimsuky is leveraging GitHub and other code hosting services to deliver malware and exfiltrate data from Ukrainian experts in diplomacy and international policy. This activity, designated Operation GitPower, combines deceptive emails with technical exploits to compromise targets.
Genians researchers detailed this campaign in a report published on October 12, 2026. They linked the current attacks to earlier Operation GitPower efforts through shared code structures, file naming conventions, and scheduled task methodologies. The group maintains its core attack framework while varying email themes to evade detection.
Attack Methodology and Technical Details
One specific incident began on August 6 with a fraudulent invitation to the Korea Cyber Security Conference. The initial email contained no malicious links or attachments, relying instead on realistic event details and offers of travel support to build trust. Attackers only sent harmful files after recipients replied to the message.
The follow-up communication contained a ZIP archive with invitation materials. Later iterations used password protection to hinder inspection by email security tools. Inside the archive, a legitimate-looking HTML file concealed a Windows shortcut disguised as a PDF document.
Opening the malicious shortcut executes command prompt instructions that use curl to download additional files from GitLab. Depending on the variant, a decoy PDF opens while a background download saves a Visual Basic script. This initial script retrieves a secondary component that executes directly in memory.
The loader module obscures PowerShell commands by inserting extra words, then removes them using Replace() functions just before execution. A separate attack vector on August 19 impersonated a policy researcher seeking feedback on a report regarding Russia and North Korea.
Targets and Campaign Limits
The primary targets of Operation GitPower are Ukrainian experts working in diplomacy, security, and international policy. Attackers use conference invitations and research requests to establish credibility before sending harmful files. Codeberg hosts malicious archives, while GitLab supplies decoy documents and scripts.
GitHub supports the final stages of payload delivery and data transfers for the stolen information. Despite the sophisticated use of trusted platforms, most observed attempts against Ukrainian targets were unsuccessful. This indicates a significant limitation in the campaign's reported impact.
When the initial malware delivery failed in the August 19 case, the attacker sent a September follow-up. This later attempt switched tactics to a fake meeting login page designed to steal account credentials directly from the victim.
What should you do?
Security teams should monitor for unexpected replies to conference invitations or research requests. Verify the authenticity of any email offering travel support or payment before engaging further. Check for password-protected ZIP archives in professional communications, as these may attempt to bypass security scanning tools.
WATCH FOR:
- Unsolicited emails referencing specific conferences or policy research reports.
- Password-protected archives sent after an initial reply to a benign message.
- Windows shortcut files disguised as PDF documents in email attachments.
- PowerShell commands that use string manipulation functions to hide execution logic.
Frequently asked questions
Which platforms does Kimsuky use to deliver malware in Operation GitPower?
The group uses GitHub for payload delivery and data transfers, GitLab for decoy documents, and Codeberg to host malicious archives.
How does the malware loader hide its PowerShell commands?
The loader inserts extra words into the commands and then removes them using Replace() functions just before execution.
Were the attacks against Ukrainian experts successful?
Most observed attempts against Ukrainian targets were unsuccessful, limiting the campaign's reported impact.
