Do Son 
Current state of nemotomui/gabiaxis on 2 November 2026, with the latest commit deleting the aefsany directory
At a Glance
| Actor or Group | Kimsuky (suspected North Korean state-sponsored group, also tracked as TA406 and APT43) |
| Activity Type | Spear-phishing, living-off-the-land AnyDesk staging, GitHub Pages hosting, and credential harvesting |
| Targets or Victims | Ukrainian diplomatic and defense specialists, South Korean citizens, and German commercial targets |
| Scale | At least 25 live accounts, roughly 120 repositories, and 8 AnyDesk deployment cycles (financial losses unconfirmed) |
| Jurisdiction / Law Enforcement Status | State-sponsored DPRK jurisdiction; subject to United Nations sanctions and FBI threat advisories |
TL;DR
On November 2, 2026, researchers found twenty-five GitHub accounts linked to the Kimsuky Operation GitPower campaign still active. Specifically, the operators use roughly 120 public repositories to stage remote access software and regional phishing lures. Furthermore, the threat actor executed new deployment cycles hours before analysts completed their census.
What Happened
On October 12, 2026, Genians Security Center published an advisory detailing an espionage campaign named Operation GitPower. That initial report documented attacks against Ukrainian foreign policy experts and listed thirty-seven operator email addresses. However, Genians named only a single GitHub profile at that time. Three weeks later, researchers at VULONE conducted a metadata audit across the public commit index.
By querying each operator email address, the team uncovered twenty-five active accounts controlling about 120 repositories. Remarkably, none of these hosting locations suffered a takedown following the October disclosure. Instead, the operators continued updating files and staging new payloads across the platform. According to the VULONE Team research report, “The activity is live. It is state-linked DPRK espionage infrastructure that the public report did not fully map.”
AnyDesk Staging and Upload Cycles
The clearest evidence of ongoing activity centers on a repository named gabiaxis under the account nemotomui. The operator uses this project to stage customized AnyDesk remote administration packages for new victims. Furthermore, the repository follows a strict upload-then-delete sequence. The operator uploads a folder containing batch files, PowerShell scripts, and configuration data through the web interface. About thirty minutes later, the operator removes the entire folder from public view.
VULONE tracked eight separate deployment cycles in this repository between August 24 and November 2, 2026. In fact, five of these cycles took place after the Genians report appeared. The most recent cycle occurred on November 2 between 09:27 and 10:01 UTC. During that run, the operator updated configuration files and deleted the directory after thirty minutes. The commit history explicitly references updates to AnyNet configuration parameters, private keys, certificates, and password hashes.
Multilingual Phishing Lures
Beyond remote management tools, the group deployed fresh lure waves targeting diverse regions. On October 16, four newly created accounts pushed an identical Korean-language archive within twenty-five seconds. The archive masqueraded as health checkup documentation. Later that afternoon, a fifth account uploaded and deleted the same file.
Additionally, researchers discovered German-language purchase contract archives on an account named megabox26. The operator hosted these files from September 9 until October 26. Then, on October 26, the attacker deleted the ZIP archives and published a GitHub Pages site. That site hosted an alert script to redirect visitors to malicious downloads.
Who Is Behind It
Security researchers attribute this infrastructure to Kimsuky with high confidence. Kimsuky is a state-backed cyberespionage unit affiliated with North Korea’s Reconnaissance General Bureau. Industry trackers also follow this group under the designations TA406 and APT43. The attribution rests on direct email matches from the Genians advisory and confirmed operational habits.
Furthermore, external threat intelligence corroborates this assessment. The tracking portal Lazarus.day indexed the gabiaxis repository as a Kimsuky artifact on September 8, 2026. That listing cited research presented by ENKI at the KCSCON conference. In addition, prior reporting from Proofpoint and Digital Security Lab Ukraine documented similar account-farm behaviors. Specifically, the operators create random repository names, upload single-file archives, and delete staging files within minutes.
Impact and Scale
The campaign spans at least twenty-five confirmed accounts and roughly 120 active repositories. While the repositories contain no victim hostnames, the eight AnyDesk cycles indicate at least eight separate compromise attempts. Five of those deployment events occurred after public disclosure, proving that the threat actor operates without interruption.
Moreover, the campaign targets victims across multiple languages and strategic sectors. Initial attacks focused on Ukrainian foreign policy, defense, and international security experts. However, newer waves expanded targeting to South Korean citizens using healthcare lures. Similarly, the German contract lures reveal an expanded European focus that previous reporting missed. Because the operators rotate disposable repositories rapidly, tracking victim numbers remains difficult.
What Comes Next and Defense Guidance
State-sponsored actors frequently use legitimate code-hosting services to bypass corporate web proxies. Because these repositories use trusted domains, standard perimeter filters often fail to block the traffic. Therefore, organizations must implement behavioral detection to identify unusual outbound connections to code repositories.
Security teams should inspect endpoint telemetry for unexpected AnyDesk installations. Specifically, defenders should monitor script interpreters executing commands from temporary or public folders. Network administrators must also review proxy logs for connections to known staging accounts and GitHub Pages domains. Finally, organizations operating in sensitive sectors should block unapproved remote desktop applications to prevent unauthorized administrative sessions.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
