Kimsuky's Operation GitPower Abuses 120+ GitHub Repos for Espionage, Stays Active Post-Disclosure
Kimsuky (tracked also as TA406/APT43), a North Korean state-linked espionage group, continues to operate a large GitHub-based staging infrastructure despite public disclosure. Initially reported by Genians Security Center on October 12, 2026 as Operation GitPower targeting Ukrainian foreign policy experts, the campaign was found by VULONE Team on November 2, 2026 to involve at least 25 active GitHub accounts controlling roughly 120 public repositories, none of which were taken down after the initial report. The actors use these repositories to stage customized AnyDesk remote administration packages and multilingual phishing lures (Korean health-checkup lures, German purchase-contract archives) in short upload-then-delete cycles, with new deployment activity confirmed hours before researchers completed their census.
Detalhes técnicos
The repository gabiaxis under account nemotomui exhibited a strict upload-then-delete pattern: batch files, PowerShell scripts and configuration data (AnyNet config parameters, private keys, certificates, password hashes) were uploaded and removed within roughly 30 minutes. VULONE tracked eight such deployment cycles between August 24 and November 2, 2026, five occurring after the Genians disclosure. On October 16, four newly created accounts pushed an identical Korean-language archive disguised as health checkup documentation within 25 seconds, followed by a fifth account repeating the upload. The account megabox26 hosted German-language purchase contract ZIP archives from September 9 to October 26, after which it switched to a GitHub Pages site redirecting visitors to malicious downloads via an alert script. Attribution to Kimsuky is based on direct email matches from the Genians advisory and corroborated by Lazarus.day, ENKI (KCSCON), Proofpoint, and Digital Security Lab Ukraine, which documented similar disposable repository/account-farm tactics.
Remediação
Defenders should deploy behavioral detection for unusual outbound traffic to code-hosting platforms, since trusted domains like GitHub often bypass perimeter filtering. Security teams should inspect endpoints for unexpected AnyDesk installations, monitor script interpreters executing from temporary/public folders, review proxy logs for connections to known staging accounts and GitHub Pages domains, and block unapproved remote desktop applications in sensitive-sector environments.
Linha do tempo
-
Kimsuky's Operation GitPower Abuses 120+ GitHub Repos for Espionage, Stays Active Post-Disclosure
ler a análise desta fonte ocultar
Kimsuky (tracked also as TA406/APT43), a North Korean state-linked espionage group, continues to operate a large GitHub-based staging infrastructure despite public disclosure. Initially reported by Genians Security Center on October 12, 2026 as Operation GitPower targeting Ukrainian foreign policy experts, the campaign was found by VULONE Team on November 2, 2026 to involve at least 25 active GitHub accounts controlling roughly 120 public repositories, none of which were taken down after the initial report. The actors use these repositories to stage customized AnyDesk remote administration packages and multilingual phishing lures (Korean health-checkup lures, German purchase-contract archives) in short upload-then-delete cycles, with new deployment activity confirmed hours before researchers completed their census.
Technical Details
The repository gabiaxis under account nemotomui exhibited a strict upload-then-delete pattern: batch files, PowerShell scripts and configuration data (AnyNet config parameters, private keys, certificates, password hashes) were uploaded and removed within roughly 30 minutes. VULONE tracked eight such deployment cycles between August 24 and November 2, 2026, five occurring after the Genians disclosure. On October 16, four newly created accounts pushed an identical Korean-language archive disguised as health checkup documentation within 25 seconds, followed by a fifth account repeating the upload. The account megabox26 hosted German-language purchase contract ZIP archives from September 9 to October 26, after which it switched to a GitHub Pages site redirecting visitors to malicious downloads via an alert script. Attribution to Kimsuky is based on direct email matches from the Genians advisory and corroborated by Lazarus.day, ENKI (KCSCON), Proofpoint, and Digital Security Lab Ukraine, which documented similar disposable repository/account-farm tactics.
Remediation
Defenders should deploy behavioral detection for unusual outbound traffic to code-hosting platforms, since trusted domains like GitHub often bypass perimeter filtering. Security teams should inspect endpoints for unexpected AnyDesk installations, monitor script interpreters executing from temporary/public folders, review proxy logs for connections to known staging accounts and GitHub Pages domains, and block unapproved remote desktop applications in sensitive-sector environments.