Do Son 
opencode Interface
At a glance
| Field | Details |
|---|---|
| Actor or Group | Kimsuky (North Korean state-sponsored threat group) |
| Activity Type | Spearphishing, malware delivery, and AI-assisted decoy creation |
| Targets or Victims | South Korean financial institutions, retail businesses, and corporate personnel |
| Scale | Mass-produced decoy documents deployed across multiple campaign clusters |
| Jurisdiction Status | Tracked by private threat researchers; Kimsuky is subject to international sanctions |
| Source | Genians Security Center (Operation GitPower tracking) |
Executive Summary
Threat researchers have confirmed that North Korean hackers are leveraging artificial intelligence to scale their cyber espionage operations. Specifically, the notorious Kimsuky uses AI agent opencode to automate the creation of fraudulent documents. The attackers distribute these AI-generated decoys via malicious shortcut files to breach corporate networks.
What Happened in the Campaign
Genians Security Center analysts intercepted 13 malicious LNK files during August 2026. These files masqueraded as standard financial documents, insurance records, and certificate renewals. However, deep analysis of the document metadata revealed a surprising origin. The researchers noted, “Traces of the AI agent ‘opencode‘ identified in decoy PDF metadata, showing the continued use of AI and LLMs to mass-produce decoys.”
The attackers utilized opencode, a terminal-based open-source coding assistant, to generate the text and structure of their lures. Because the group mass-produced these files rapidly, they made several operational errors. The Genians report highlighted that “The body text of the opencode family documents contains unreplaced placeholder text that appears to have been generated by an LLM.” For instance, the hackers forgot to remove tags like “(temporary value)” before sending the files to victims.
Evolution of Delivery Tactics
The attack chain begins when a user extracts a ZIP archive and clicks the disguised shortcut. The LNK file executes a hidden PowerShell script heavily padded to inflate file size and evade scanners. Next, the script contacts GitHub using hardcoded Personal Access Tokens (PATs) to retrieve the payload. The researchers also observed the group adopting Pastebin as a secondary command channel to ensure persistence if GitHub blocked their repositories. For a comprehensive technical breakdown, read the Genians Threat Intelligence report.
Who Is Behind the Activity
Security analysts attribute this activity to Kimsuky with high confidence. Genians associates this cluster with their ongoing tracking of “Operation GitPower”. The group reused specific technical fingerprints, such as adding exactly 300 leading spaces to conceal command-line arguments within the LNK properties. Furthermore, the custom arithmetic substitution decoder used to decrypt payloads matches previously documented Kimsuky toolsets.
Impact and Operational Scale
Kimsuky traditionally targeted diplomats, academics, and national security officials. However, this campaign demonstrates a significant shift in targeting priorities. The group now attacks retail operators and corporate financial departments. By employing AI tools, Kimsuky can launch simultaneous campaigns across different sectors without writing unique content manually. The attackers also introduced aggressive anti-analysis routines. The malware now actively searches for virtual machines, reverse-engineering tools like x64dbg, and specific sandbox usernames before executing.
What Comes Next and Defense Strategies
As state-sponsored actors integrate AI into their operational pipelines, the volume and quality of phishing lures will inevitably increase. Defenders can no longer rely on spotting grammatical errors to identify threats. Security teams must pivot toward behavioral detection. Organizations should monitor for abnormal PowerShell executions spawned from LNK files. Additionally, network administrators should flag unexpected outbound connections to raw.githubusercontent.com and Pastebin that utilize API authentication headers.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
