Kimsuky Targets Ukrainian Diplomats With Fake Conference Invites in Operation GitPower
George antony 
North Korea-linked Kimsuky is sending Ukrainian diplomacy and security experts fake conference invitations and requests for research collaboration. It then uses GitHub, GitLab, and Codeberg to deliver malware and collect stolen data, according to a Genians Security Center report dated October 12, 2026. Most of the observed attempts failed.
Kimsuky is a cyber-espionage group associated with North Korea. The group reportedly targeted Ukrainian diplomats using fake conference invitations. These invitations were designed to gain the trust of the recipients. The campaign was identified as Operation GitPower.
Users should verify the sender before opening email attachments. They should avoid clicking suspicious links in unexpected emails. Keeping operating systems and security software updated can reduce risks. Suspicious messages should be reported to the cybersecurity team.
Fake Conference Invites in Operation GitPower
The first email carries no links or attachments, so security filters have little to flag. In one campaign, sent on August 6, 2026, the sender posed as the organizers of the 14th Korea Cyber Security Conference (KCSCON 2026). It offered the target a speaking slot, airfare, accommodation, and an honorarium.
The sender used a Proton Mail account instead of the organizer’s domain. Only targets who replied received a ZIP file, so the attackers filtered out everyone else.
A second campaign on August 19 impersonated a European East Asia specialist. It asked a Ukrainian policy expert to review a report on Russia–North Korea military cooperation. The malicious Codeberg link arrived about 2 hours and 18 minutes after the first email.
The archives held a legitimate-looking HTML invitation and a malicious LNK file named with a fake “.pdf” extension. Windows hides the real extension, so victims saw what looked like a PDF. A later variant used a password-protected archive to evade email scanning.
The LNK launched cmd.exe and used curl to pull a script from GitLab. The script was saved as a VBE file under C:\Users\Public\Music. That script fetched a second-stage script and ran it in memory.
The second stage did the following:
- Registered a scheduled task disguised as a Google update component. It ran every 15 minutes.
- Collected systeminfo output and a listing of the Downloads folder.
- Base64-encoded the data and uploaded it to a GitHub repository through the Contents API, using a hardcoded token.
- Deleted its temporary files and the original VBE to reduce forensic traces.
The attackers also quickly fixed their own bugs. An early version had mismatched filenames and a faulty deletion check; a revised version fixed both.
Editorial insight: When attackers host commands and stolen data on GitHub, blocking by domain reputation no longer works. Defenders need behavioral detection: an LNK file spawning cmd.exe, curl and VBScript, followed by API writes to a code repository from an ordinary user workstation.
Genians linked the cases through several shared artifacts:
- The address info.seclab.noreply@gmail[.]com appeared in both campaigns.
- The sender account was kcscon@proton[.]me.
- A Kakao Mail address, ken0723@kakao[.]com, appeared in the commit metadata.
- The junk string “wolf” was used in obfuscation, a code artifact repeatedly seen in GitPower activity.
- Exfiltrated files were named SYS_yyyy-MM-dd_HHmm.tmp and DOWN_yyyy-MM-dd_HHmm.tmp.
The report also ties the techniques to earlier CHM-based attacks. Proofpoint’s 2025 reporting on TA406, which partly overlaps with Kimsuky, described similar LNK and CHM lures aimed at Ukrainian government bodies.
Genians assesses that the espionage may aim to learn about North Korean troop losses and the handling of prisoners of war. Two captured North Korean soldiers were transferred to South Korea in September 2026, so the stakes for that information are high.
The report also says Kimsuky is using AI agents to create decoy documents and write malicious scripts. It is also attempting to build a local large language model environment.
Genians recommends stronger EDR detection and threat hunting for LNK, PowerShell, and GitHub abuse. It also calls for faster sharing of infrastructure, TTP, and IoC data among countries and private vendors.
Practical steps for defenders:
- Show file extensions in Windows.
- Block or detonate LNK files in email archives.
- Treat unsolicited speaking or research invitations with suspicion, especially when the sender’s domain doesn’t match the organizer’s.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
