Kimsuky Abuses GitHub and Zoom for Ukrainian Espionage: How It Works

North Korean APT group Kimsuky conducted a spear-phishing campaign against Ukrainian experts in diplomacy, security, and international policy, abusing GitHub, GitLab, and Codeberg to host payloads, control infections, and exfiltrate data. The Genians Security Center report, published October 12, 2026, documents a multi-stage attack chain that begins with reply-baiting — a technique that bypasses traditional email filters — and proceeds through LNK files disguised as PDFs, in-memory PowerShell scripts, and a fake Zoom installer. Most observed attempts were unsuccessful.

How Reply-Baiting Bypasses Filters

The campaign opens with an email containing neither attachments nor links: an apparent request to confirm availability for an event or provide feedback on a report. The first observed lure, dated August 6, 2026, impersonated the organizer of the Korea Cyber Security Conference (KCSCON 2026) using real event details, praising the recipient's work and offering travel support and payment. A second lure, from August 19, 2026, posed as a researcher from a European think tank requesting comments on a Russia–North Korea report.

Only after the victim replies do the attackers send a ZIP archive containing an LNK file with a double extension — for example KCSCON_2026_Official_Invitation.pdf.lnk — and a PDF icon. The LNK exploits Windows' default behavior of hiding known extensions. When clicked, it launches cmd.exe which uses curl to download files from GitLab: a VBE script executes in the background while a decoy PDF opens simultaneously, reducing the perception of anything unusual. Follow-up scripts delete temporary and initial files to limit forensic evidence.

The Multi-Stage Chain: From LNK to GitHub Contents API

The chain spans three platforms with distinct roles. Codeberg hosts malicious archives; GitLab serves decoy documents and intermediate scripts; GitHub supports both final payload delivery and exfiltration of stolen data. This geographic and functional distribution makes reputation-based blocking difficult: none of the platforms is compromised, all are used legitimately.

Collected data — systeminfo and a listing of the Downloads folder — is Base64-encoded and uploaded via the GitHub Contents API using a hardcoded access token. The choice of the official API, rather than a random endpoint, allows the traffic to blend with that of legitimate developers. September 2026 samples, themed peace-report and a researcher CV, used shortcuts that downloaded LICENSE (a VBScript) and okay.md (a PowerShell script) from GitHub, confirming reuse of this architecture.

Persistence is achieved through scheduled tasks that mimic known software updates: a Google update task every 15 minutes collects system data; a OneDriveUpdateScheduler task every minute launches PowerShell with an execution-policy bypass toward a C2 server on TCP port 12345, with plaintext authentication. The fake Zoom installer adds a Zoom-Auto-Installer task every minute that runs wscript.exe: the embedded PowerShell matches code previously hosted as okay.md.

"Most observed attempts against the Ukrainian targets were unsuccessful, an important limit on the campaign's reported impact." — Genians Security Center

Why Attribution to Kimsuky Goes Beyond Email Themes

Genians linked the Ukrainian activity to Kimsuky through combined technical evidence, not merely email themes or GitHub usage. Convergence points include shared filenames (first.ini, help.ini), the wolf string for obfuscation, code structure, and data-upload methods traceable to previous Operation GitPower campaigns.

The dossier does not specify whether the credential-phishing follow-up observed in September, four weeks after a failed malware attempt, was operated by the same actor. Genians considers alternatives such as a different operator, translation tools, or AI-generated content, citing gender inconsistencies in the phishing text.

The geopolitical context suggests the targeting supports intelligence collection on the Russia–Ukraine war and South Korea–Ukraine cooperation, including the handling of captured North Korean prisoners. However, the dossier does not establish a direct operational link to North Korean troop deployments in Russia. Related repositories contained Japanese-language decoy documents; Genians does not verify whether this indicates active interest in Japanese targets or only preparatory material.

What to Do Now

Recommendations from Sources

• Correlate endpoint–network behavior: detect the sequence LNK→cmd.exe→curl→VBE→PowerShell.
• Do not generically block GitHub: sources explicitly advise against reputation-based blocking, calling it unsustainable and technically ineffective.

Analysis

The living-off-trusted-land paradigm — the use of legitimate platforms as the attack architecture itself — represents a shift in APT tradecraft. This editorial analysis rests on the observation that GitHub, GitLab, and Codeberg are not merely delivery vehicles but structural components of the command-and-control chain.

Limits and Uncertainties

The Genians report presents significant limitations. Direct access to the primary report is not available: information is based on the Genians Security Center report of October 12, 2026, as reported by editorial sources. The exact number of confirmed Ukrainian victims is not quantified; Genians states only that most attempts failed. The extent of any data actually stolen is not specified. The hypothesis of interest in Japanese targets, based on Japanese-language decoy documents, is unverified. It is not confirmed whether the September credential phishing is attributable to the same operator as the earlier stages. No government confirmation of the Kimsuky attribution is available; it is a vendor assessment, though consistent with previous Proofpoint reporting.

Information is based on the Genians Security Center report of October 12, 2026, as reported by editorial sources; direct access to the primary report is not available.

Information has been verified against cited sources and is current as of publication.

Sources

• https://cybersecuritynews.com/kimsuky-operation-gitpower/
• https://gbhackers.com/fake-zoom-installers-exploited/
• https://securityonline.info/kimsuky-spear-phishing-ukraine/
• https://www.genians.co.kr/en/blog/threat_intelligence/operation-gitpower
• https://www.cryptika.com/kimsuky-operation-gitpower-uses-github-to-deliver-malware-and-steal-data/
• https://cybersecuritynews.com/kimsuky-uses-local-llms/