Genians Says Kimsuky Expanded Operation GitPower to Ukrainian Policy Experts With Reply-Bait Lures and GitHub Exfiltration

SINGAPORE - Genians Security Center said on Oct. 12, 2026 that North Korea-linked Kimsuky has expanded Operation GitPower beyond its usual South Korea focus to Ukrainian experts in diplomacy, security, and international policy, using reply-bait spear phishing and legitimate development platforms for malware delivery and data theft. The report says initial emails carried no links or attachments, then followed with password-protected archives only after targets replied. Those archives delivered LNK shortcuts disguised as PDF invitations or research files that pulled follow-on scripts from GitLab and GitHub, registered scheduled tasks that mimicked Google or OneDrive updates, and uploaded system information through the GitHub Contents API. Genians says most of the Ukraine attempts it examined were unsuccessful, but the tradecraft still gives SOC teams a concrete hunt list for LNK-to-curl-to-Git chains.

One cluster impersonated organizers of the 14th Korea Cyber Security Conference, scheduled for Seoul on Sept. 8, 2026. Genians says a Proton Mail account presented as KCSCON emailed a Ukrainian diplomacy and security expert on Aug. 6, 2026, offering airfare, lodging, and a speaker honorarium while asking only whether the recipient would speak and wanted an official PDF invitation. After a reply, the actor sent ZIP archives that held a legitimate-looking HTML invitation beside an LNK file with a double PDF extension and PDF icon. The LNK launched cmd.exe, used curl to fetch decoy PDFs and a first.ini script from GitLab repositories Genians identifies as kickball12/bahubali and galata20/shiba, saved the script as a VBE under C:\Users\Public\Music, and executed it. Genians says the follow-on help.ini module registered a GoogleUpdateTaskMachineUA scheduled task to run every 15 minutes, collected systeminfo output and a Downloads folder listing, Base64-encoded the results into SYS_ and DOWN_ timestamped files, and uploaded them with a hardcoded access token through the GitHub Contents API before deleting temporary traces.

A second cluster used the same reply-bait pattern while impersonating a European East Asia policy researcher seeking feedback on Russia-North Korea military cooperation. Genians says the first email on Aug. 19, 2026, local Ukraine time, again lacked malicious content; a second email about two hours later linked to a Codeberg raw archive whose Ukrainian filename matched an analytical report. The LNK again pulled first.ini from the same GitLab infrastructure, displayed a decoy PDF that Genians says was actually a Korea University immigration-conference poster rather than the promised report, and reused the VBE and GitHub exfiltration framework. About four weeks later, on Sept. 16, the same sender returned with a Google Meeting Request that mixed Google and Zoom branding and pointed to security-zooma.serveirc[.]com, a credential-theft page Genians ties to broader serveirc[.]com phishing infrastructure also used against North Korea experts in South Korea.

Genians also documents LNK variants themed as a Russia-Ukraine peace report and a social researcher's CV, plus a 64-bit unsigned zoominstaller.exe hosted on a public GitHub repository. That executable, the report says, drops hidden desktop.vbs and desktop.ps1 scripts under C:\Users\Public\Videos, creates a Zoom-Auto-Installer scheduled task that runs every minute, connects to TCP port 12345 on 111.92.246[.]145 for authenticated remote tasking, and still downloads and launches the legitimate Zoom installer from Zoom's CDN so the victim sees a real install screen. Separate OneDriveUpdateScheduler tasks in the peace-report LNKs show the same one-minute cadence. Across the Ukraine cases and earlier Operation GitPower activity, Genians points to matching first.ini and help.ini roles, wolf-string obfuscation, GitHub Contents API upload patterns, and GoogleUpdateTaskMachineUA task naming as the attribution glue to Kimsuky.

For SOC and EDR teams, Genians stresses correlating behaviors that look individually benign: LNK execution from an archive, cmd.exe or PowerShell spawning curl against GitLab or GitHub, scripts landing in Public\Music, Public\Videos, or %APPDATA%, scheduled tasks named like Google, OneDrive, or Zoom updaters on one- to 15-minute intervals, and outbound GitHub Contents API posts with hardcoded tokens. The report says blocking every Git platform is the wrong answer; process trees, command lines, file-create paths, and the handoff from Git access to VBE or PowerShell persistence matter more. Genians also notes Japanese decoy PDFs in the same GitLab repositories used against Ukraine, and continuing Korean financial and insurance LNK campaigns that often launch obfuscated PowerShell through conhost.exe, underscoring that Operation GitPower remains an active multi-language framework rather than a one-off Ukraine spike.