Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower
Do Son 
Comparison of Cases Using "serveirc[.]com" Subdomains as Phishing Infrastructure | Image: Genians Security Center
| At a glance | |
| Actor | Kimsuky, a North Korea-linked threat group (assessed by Genians) |
| Activity | Reply-baiting spear phishing, malicious LNK files, fake Zoom installer, credential phishing |
| Targets | Ukrainian experts in diplomacy, security, and international policy |
| Scale | Several individual targets; Genians says most attempts failed |
| Status | No law-enforcement action reported |
| Source | Genians Security Center, with earlier findings from Proofpoint and Digital Security Lab Ukraine |
TL;DR
On August 6, 2026, a fake KCSCON organizer emailed a Ukrainian security expert with a speaker invitation. Genians Security Center links that email, and a string of similar lures, to a Kimsuky spear phishing campaign. The operation, part of Operation GitPower, hides malware delivery and data theft inside GitHub, GitLab, and Codeberg.
What happened
Kimsuky usually targets South Korea. This time, it went after Ukrainian civil society figures who work on diplomacy, security, and postwar recovery. Genians says this shows the group “has expanded its targeting scope beyond its traditional focus on South Korea.”
Emails built to get a reply
The first Kimsuky spear phishing emails carried no links or files. Instead, they asked a simple question and waited for an answer. Security filters had nothing to flag, and only engaged targets moved to the next stage.
One lure claimed the recipient had been chosen as a speaker at the 14th Korea Cyber Security Conference (KCSCON 2026) in Seoul. It listed the real schedule, venue, and topics. It also offered airfare, a hotel, and a speaking fee. However, the sender used a Proton Mail account, not the organizer’s domain.
A second lure targeted an international policy expert. Here, the attacker posed as an East Asia specialist at a European think tank. The fake researcher asked for feedback on a report about Russia-North Korea military ties. When the target replied, a download link arrived about two hours later.
Fake PDFs that run scripts
Next, targets received ZIP archives with shortcut (LNK) files dressed up as PDFs. Later archives used passwords, which makes email scanning harder. Once opened, the shortcut pulled a script from GitLab and often showed a decoy document.
The script set up a scheduled task disguised as a Google update. It then gathered system details and a list of files in the Downloads folder. Finally, it uploaded that data to an attacker-controlled GitHub repository through the GitHub API.
Interestingly, one decoy did not match its lure. The “analytical report” turned out to be a poster for a Korean conference on migration.
Credential theft and a fake Zoom installer
When the malware attempt failed, the attacker came back four weeks later. The third email invited the expert to a video meeting. Its subject mentioned Google Meet, while the body pointed to Zoom. The link led to a lookalike login domain.
That email also used masculine verb forms, even though the sender posed as a woman. Its tone turned oddly casual too. Genians suggests a different operator, a translation tool, or generative AI may have written it.
Separately, the group posted a fake Zoom installer on GitHub. It quietly installs a PowerShell backdoor and then runs the real Zoom setup. Similarly, other LNK lures posed as a Russia-Ukraine peace plan and a researcher’s CV.
Who is behind it
Genians attributes the campaign to Kimsuky with a detailed technical match. It bases this on matching file names, code structure, string obfuscation, and data theft methods from earlier Operation GitPower attacks. For example, both waves used scripts named “first.ini” and “help.ini” and repeated the junk string “wolf” to hide commands.
This is a vendor assessment, not an official government finding. Still, it fits earlier public reporting. In May 2025, Proofpoint reported that North Korea-linked TA406 had phished Ukrainian government agencies. Proofpoint said with high confidence that TA406 works for the North Korean government and overlaps with Kimsuky. Later, in August 2026, Digital Security Lab Ukraine described a similar reply-baiting attack that also abused GitHub.
Impact and scale
Genians found several experts targeted by the Kimsuky spear phishing lures. However, its “investigation found that most of the observed attempts were unsuccessful.” The company has not published victim counts or confirmed data losses.
Still, GitLab repositories held folders named after what appear to be victim computers. Some of those repositories also held Japanese decoy documents. That suggests the same toolkit may have been aimed at Japanese speakers. In South Korea, the group continues to spread LNK files dressed as insurance and finance forms. Genians collected 62 of them recently.
Why Ukraine, and why now
North Korea has sent troops to support Russia since 2024. In September 2026, two captured North Korean soldiers moved from Ukraine to South Korea. Genians believes the espionage may aim to learn what those soldiers told investigators. It may also track troop losses and talks between Seoul and Kyiv.
How to stay protected
The full technical breakdown appears in the Genians Security Center analysis of Operation GitPower. Based on its findings, defenders should consider these steps:
- Treat unexpected speaker invitations and review requests with caution, even when they cite real events.
- Confirm the sender through the organizer’s official website or phone number.
- Turn on file extension display in Windows so “.pdf.lnk” files stand out.
- Block or inspect password-protected archives from unknown senders.
- Alert on shortcut files that launch cmd.exe or PowerShell.
- Review scheduled tasks named after Google, OneDrive, or Zoom updates.
- Watch for PowerShell traffic to the GitHub or GitLab APIs from user machines.
- Download Zoom and similar apps only from official sites.
- Use phishing-resistant MFA to blunt fake login pages.
Overall, this Kimsuky spear phishing wave shows the group following North Korea’s interests into the Russia-Ukraine war. As Operation GitPower grows, defenders should expect the same tools to resurface with new lures.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
