Listen to this Post
A Campaign Built to Hide in Plain Sight
Cyberattacks rarely fail because attackers lack technical ability. More often, they fail because someone makes a small operational-security mistake—a forgotten file, a reused address, an exposed development artifact, or a public repository that reveals more than intended.
That appears to be what happened in a suspected Kimsuky campaign now linked to Operation GitPower.
Security researchers uncovered a collection of operational artifacts showing how the threat actor—or actors operating within the same campaign cluster—tested malware, collected information from compromised systems, maintained persistence, and used public GitHub infrastructure to support malicious activity.
The campaign is particularly notable because it demonstrates how modern threat operations increasingly blur the line between conventional malware infrastructure and legitimate developer services. Instead of relying exclusively on dedicated command-and-control servers, the attackers used GitHub’s Raw Content functionality to distribute scripts and payloads.
For defenders, that creates a difficult problem: traffic to GitHub does not automatically look suspicious.
Operation GitPower and the Kimsuky Connection
Researchers tracking Operation GitPower assess that the activity continues techniques previously associated with Kimsuky campaigns, including the use of malicious Windows shortcut files, PowerShell, and Git-based infrastructure.
Kimsuky is a North Korean-linked threat actor historically associated with espionage operations against organizations involved in diplomacy, academia, government, policy, international relations, and security.
The
Rather than attacking random organizations, the operation appears designed to reach people whose documents, communications, research, financial information, or institutional relationships could provide strategic value.
Spear-Phishing Remains the First Door
The infection chain begins with a familiar technique: spear-phishing.
Victims receive ZIP archives containing malicious LNK shortcut files disguised as ordinary documents. The filenames and associated decoys are designed to make opening the shortcut seem reasonable.
The documents reportedly imitate materials such as event information, payment forms, legal documents, research files, and embassy correspondence.
This approach works because the attacker is not asking the victim to execute something that obviously looks like malware.
Instead, the malicious shortcut is presented as something the recipient already expects to receive.
AI-Generated Documents Make the Deception More Convincing
One of the more interesting developments is the appearance of polished finance, cryptocurrency, virtual-asset, and investment-related documents that appear to have been produced with generative AI.
This matters because generative AI is now making it considerably easier to create convincing business documents at scale.
Attackers can produce cleaner formatting, more natural language, realistic financial terminology, and customized content without spending the same amount of time manually preparing every lure.
The result is a dangerous combination: traditional spear-phishing infrastructure combined with modern AI-assisted social engineering.
The LNK File Starts the Hidden Execution Chain
Once the victim opens the malicious shortcut, an obfuscated PowerShell command executes in the background.
The objective is not necessarily to immediately display obvious malicious behavior.
Instead, the campaign uses a deception layer.
A legitimate-looking PDF is displayed to the victim, creating the impression that the expected document has opened successfully.
Behind the scenes, however, PowerShell continues executing additional commands.
This technique is particularly effective because the victim sees something that appears normal while the actual infection process is already underway.
GitHub Becomes Part of the Malware Infrastructure
The campaign then retrieves additional scripts and payloads from GitHub Raw Content.
This is an important operational choice.
GitHub is a legitimate software-development platform used by millions of developers and organizations. Security teams cannot simply block every connection to GitHub without disrupting legitimate business activity.
That makes public repositories attractive to attackers.
The repository becomes another layer of camouflage.
Instead of communicating exclusively with an obviously malicious domain, malware can retrieve content through infrastructure that defenders may already consider trusted.
Hidden PowerShell Files Increase the Persistence Problem
After the initial execution, the malware creates hidden PowerShell files in locations such as temporary directories or AppData.
The use of these locations can make investigation more complicated, particularly on systems where defenders are not routinely monitoring unusual script creation.
The campaign also establishes persistence through a scheduled task.
Scheduled tasks are legitimate Windows functionality, which makes them particularly useful for malware.
A malicious task can execute at regular intervals, allowing an attacker to regain execution after a reboot or other interruption.
The Most Revealing Mistake: A Private IP Address
Perhaps the most valuable discovery for researchers was not a sophisticated exploit.
It was an internal IP address.
Investigators discovered a GitHub upload record for an infection-information file named:
172.16.11[.]141-0313_0319-0956_info.txt
The filename itself appears to follow the naming convention generated by the malware’s host-profiling functionality.
The presence of a private network address suggests that the artifact was associated with an internal testing environment rather than a victim machine.
For defenders and researchers, this is exactly the kind of operational-security mistake that can turn an otherwise opaque campaign into a much clearer picture.
What the Host-Profiling Script Collects
The
Reportedly collected information includes the operating-system version, system architecture, configuration details, installation and boot history, and currently running processes.
The active network
The information is then written into a structured text file containing the timestamp and host details.
From an
Is the system running a useful operating system?
Is the machine part of an interesting organization?
What security software might be present?
What processes are currently active?
Is the environment worth further exploitation?
Host profiling effectively gives the operator reconnaissance information before deciding what happens next.
The Test-com1.json Connection
Researchers also identified a connection between the infection-information artifact and a file named Test-com1.json.
Evidence indicates that the file was reviewed using the Cursor AI development environment.
That detail is especially revealing because it suggests an overlap between malware development and operational infrastructure.
In other words, researchers were not merely observing the final malware.
They were able to see traces of the development and testing process surrounding it.
That is valuable intelligence.
A production payload may reveal what the attacker wants defenders to see. Development artifacts can reveal what the attacker accidentally forgot to hide.
Development Infrastructure Can Become an Intelligence Goldmine
This incident illustrates an increasingly important principle in modern threat intelligence: defenders should investigate the ecosystem surrounding malware, not just the malware itself.
Repositories, filenames, development logs, testing addresses, build artifacts, comments, configuration files, and accidental uploads can reveal relationships that are invisible from a single sample.
An attacker may remove a malicious payload from a repository, but an old filename may remain indexed.
A command-and-control server may disappear, but a testing address may survive inside a configuration artifact.
A developer may delete a file, but a copy may already have been collected by researchers.
The digital trail can therefore outlive the infrastructure itself.
Another Testing Address Emerges
A separate artifact reportedly exposed another IP address:
169.254.33[.]137
This address was observed in malware-testing activity involving files disguised as images.
The naming is notable because the files reportedly appeared to be ordinary images, including:
apple.png
and
rabbit.png
But these were not ordinary image files.
They reportedly contained RC4-encrypted .NET AsyncRAT payloads.
This is a classic example of file-type camouflage.
The extension suggests an image.
The underlying content serves an entirely different purpose.
AsyncRAT Adds a Powerful Remote-Access Layer
AsyncRAT is a remote-access trojan capable of providing attackers with extensive control over compromised Windows systems.
Using such a payload can potentially give an operator the ability to conduct additional reconnaissance, execute commands, manipulate files, and maintain control over an infected environment.
The use of encrypted payloads disguised as image files also complicates superficial inspection.
A defender looking only at filenames and extensions could easily miss what is actually stored inside the file.
More Payload Variants Reveal Command-and-Control Infrastructure
Researchers also identified other payload variants associated with the campaign.
Some variants reportedly contained the command-and-control address:
112.216.9[.]171
The address appeared in payloads masquerading as:
fox.png
leopard.png
lion.png
and
wolf.png
These filenames are more than cosmetic details.
They provide researchers with a way to connect apparently separate samples to a common infrastructure or development lineage.
Once several samples share the same C2 address, encryption method, naming convention, repository behavior, or code structure, investigators can begin reconstructing the broader campaign.
Why Public Repositories Are So Attractive to Attackers
Using GitHub as part of an attack infrastructure strategy offers several advantages.
First, the infrastructure is trusted and widely used.
Second, organizations often cannot block GitHub completely.
Third, the attacker can change repository content without rebuilding an entire dedicated server infrastructure.
Fourth, defenders may have difficulty distinguishing malicious Raw Content traffic from legitimate software-development activity.
Fifth, public repositories can provide attackers with a convenient distribution mechanism.
This does not mean GitHub itself is responsible for the campaign.
The problem is the abuse of a legitimate service.
The same pattern has appeared across the wider threat landscape, where attackers increasingly exploit cloud storage, code-hosting platforms, package repositories, collaboration systems, and other legitimate services.
The Bigger Trend: Living Off Legitimate Infrastructure
The Kimsuky-linked activity fits into a broader cybersecurity trend often described as living off the land or abusing trusted services.
The objective is simple: make malicious activity look ordinary.
A connection to an unknown server is suspicious.
A connection to a widely used cloud platform may not be.
A custom executable downloaded from an unfamiliar domain may trigger security controls.
A PowerShell script retrieved through an established developer service can be harder to distinguish from normal administrative activity.
The attackers are therefore not necessarily trying to hide the existence of network traffic.
They are trying to hide its meaning.
Why PowerShell Continues to Matter
PowerShell remains attractive because it is already present on Windows systems and can perform powerful administrative and scripting functions.
It can download content, manipulate files, execute commands, inspect the system, create scheduled tasks, and interact with Windows components.
That makes PowerShell extremely useful for both legitimate administrators and attackers.
The lesson is not that organizations should disable PowerShell everywhere.
Instead, defenders should monitor how PowerShell is being used.
Obfuscated commands, unusual encoded content, unexpected downloads, execution from temporary directories, suspicious parent-child processes, and scheduled tasks launching scripts should receive particular attention.
Deep Analysis
Detect Suspicious PowerShell Activity
Defenders can begin by reviewing PowerShell operational logs and looking for suspicious command execution patterns.
For environments using PowerShell logging, administrators can inspect relevant Windows event logs with commands such as:
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 100 | Select-Object TimeCreated, Id, Message
The objective is not simply to find the word “PowerShell.”
Investigators should look for unusual command-line behavior, encoded commands, downloads, execution from temporary paths, and scripts launched by unexpected applications.
Search for Suspicious Scheduled Tasks
Because the campaign reportedly establishes persistence through scheduled tasks, defenders should inventory tasks and examine those that launch PowerShell or scripts.
Get-ScheduledTask |
Where-Object {
$_.Actions.Execute -match "powershell|wscript|cscript|mshta"
} |
Select-Object TaskName, TaskPath, State
This should be treated as an investigative starting point rather than a standalone detection rule.
Many legitimate administrative tasks also use scripting engines.
Context matters.
Inspect AppData and Temporary Directories
Security teams should pay particular attention to newly created PowerShell files in user-writable locations.
For example:
Get-ChildItem "$env:APPDATA","$env:TEMP" -Recurse -File -ErrorAction SilentlyContinue |
Where-Object {
$_.Extension -in ".ps1",".psm1",".bat",".cmd"
} |
Select-Object FullName, CreationTime, LastWriteTime
Unexpected scripts appearing shortly after a suspicious email or LNK execution should be investigated.
Hunt for LNK-Based Execution
Malicious shortcut files are particularly important in this campaign.
Defenders can search for recently created .lnk files and correlate them with downloads, email attachments, browser activity, and process creation.
Get-ChildItem "$env:USERPROFILE\Downloads","$env:TEMP" -Recurse -Filter .lnk -ErrorAction SilentlyContinue | Select-Object FullName, CreationTime, LastWriteTime
Endpoint telemetry should then be used to determine what process was launched when the shortcut was opened.
Monitor GitHub Raw Content Carefully
Blocking GitHub outright is usually impractical.
A more effective strategy is behavioral monitoring.
Security teams should investigate endpoints that unexpectedly download PowerShell scripts or executable content from GitHub Raw Content, particularly when the download is followed by execution from AppData, Temp, or other user-writable directories.
The combination is much more meaningful than any single indicator.
Investigate Image Files That Are Not Images
Files named .png, .jpg, or similar should not automatically be trusted.
Security tools should verify file signatures and actual content types rather than relying exclusively on extensions.
A file claiming to be a PNG but containing a .NET assembly or encrypted binary payload deserves additional scrutiny.
This is especially important when the file arrives from an unusual repository or is consumed by a script.
Search for the
The reported infrastructure includes the following defanged indicators:
112.216.9[.]171
169.254.33[.]137
172.16.11[.]141
The addresses should remain defanged in ordinary documentation.
Threat hunters can search their SIEM, EDR, proxy, DNS, firewall, and network telemetry for historical connections or related artifacts.
Example SIEM Hunting Logic
A generic SIEM investigation can combine network indicators with suspicious execution behavior.
For example, conceptually:
(network.destination.ip == 112.216.9.171)
OR
(file.name IN (apple.png,rabbit.png,fox.png,leopard.png,lion.png,wolf.png))
OR
(process.command_line CONTAINS powershell)
Organizations should adapt this logic to their own SIEM syntax and telemetry.
Why IOC-Only Detection Is Not Enough
Indicators eventually expire.
Attackers can change IP addresses, create new repositories, rename files, rotate payloads, and modify infrastructure.
Behavioral indicators are harder to replace.
A scheduled task launching PowerShell from a user-writable directory is suspicious regardless of the exact C2 address.
A supposed image that is actually an encrypted executable is suspicious regardless of its filename.
An LNK file that silently starts PowerShell while opening a decoy PDF is suspicious regardless of the lure’s subject.
This is why modern detection programs need both IOC intelligence and behavioral analytics.
What Undercode Say:
- The Most Dangerous Detail Is Not the Malware
The most revealing part of this campaign may be the operational mistakes.
- Attackers Invest Heavily in Hiding Their Payloads
But one forgotten test artifact can expose the entire development process.
3. Private IP Addresses Are Valuable Intelligence
They can reveal internal infrastructure that was never intended to become public.
- GitHub Is Becoming Part of the Threat Landscape
Legitimate developer platforms are increasingly being incorporated into malicious infrastructure.
5. Trust Is Becoming an Attack Surface
Organizations naturally trust services that are widely used for legitimate business.
6. That Trust Can Be Manipulated
Attackers exploit the reputation of legitimate platforms rather than building suspicious infrastructure from scratch.
7. Kimsuky-Linked Operations Continue to Evolve
The campaign demonstrates continued adaptation in phishing, payload delivery, and infrastructure management.
8. LNK Files Remain Dangerous
Despite years of awareness, shortcut files remain effective social-engineering weapons.
9. PowerShell Remains a Double-Edged Sword
The same technology used by administrators can become a powerful post-compromise execution mechanism.
10. Decoy Documents Still Work
The victim does not necessarily need to see an error or warning.
11. A Familiar PDF Can Be Enough
Displaying the expected document can dramatically reduce suspicion.
12. AI Is Changing Phishing Lures
Attackers can now create polished documents with less effort.
13. Financial Themes Are Particularly Dangerous
Investment and cryptocurrency documents can create urgency and curiosity.
- Development Artifacts Should Be Treated as Intelligence
They can reveal how malware was built and tested.
- Cursor Appearing in the Investigation Is Significant
It illustrates how modern development tools can become part of the malware-development ecosystem.
- AI Coding Tools Are Not Inherently Malicious
The concern is how legitimate development technologies are used.
- Security Teams Must Watch the Entire Lifecycle
Development, testing, deployment, execution, persistence, and C2 all matter.
18. File Extensions Are Weak Evidence
A .png filename does not prove that the file contains an image.
19. Content Inspection Is Essential
Security controls should examine what files actually contain.
20. AsyncRAT Increases the Stakes
Remote-access malware can turn an initial infection into long-term surveillance.
21. Public Repositories Can Accelerate Payload Delivery
Attackers can use them as disposable or semi-disposable infrastructure.
- Blocking Every Cloud Service Is Not the Answer
Modern organizations depend on these platforms.
23. Behavioral Monitoring Is More Sustainable
The question should be what the endpoint is doing, not simply where it connects.
24. Scheduled Tasks Deserve More Attention
They remain one of the easiest persistence mechanisms to overlook.
25. Temporary Directories Should Not Be Ignored
User-writable locations are frequently abused after initial compromise.
26. Security Logs Become Critical After Phishing
Process creation, PowerShell, scheduled-task, and network telemetry can reconstruct the infection chain.
- Email Security Must Work With Endpoint Security
No single layer can reliably stop this campaign alone.
28. Sandboxing Can Reveal the Hidden Chain
Opening suspicious attachments in an isolated environment can expose secondary downloads.
29. Threat Intelligence Adds Historical Context
Known infrastructure can help organizations discover previous infections.
- Historical Hunting Is Often More Valuable Than Blocking
An IOC found today may indicate an infection that happened weeks earlier.
31. AI-Generated Lures Will Increase
The quality gap between legitimate and fraudulent documents is shrinking.
32. Social Engineering Is Becoming More Scalable
Attackers can customize content for different industries and individuals.
33. Human Awareness Still Matters
Employees should understand that a convincing document can still be malicious.
34. Security Awareness Must Explain LNK Files
Users should know that shortcuts can execute commands rather than simply open documents.
35. Developers Also Have a Security Role
Public repositories should be reviewed for accidentally exposed credentials, testing files, and operational artifacts.
- Threat Actors Are Making the Same Mistakes Developers Make
Debug files, test configurations, temporary artifacts, and naming conventions can leak information.
37. Operational Security Is Part of Cybersecurity
Technical sophistication cannot compensate for careless infrastructure management.
38. Defenders Should Hunt Relationships
The connection between a repository, a filename, a testing IP, a payload, and a C2 address may be more valuable than any individual IOC.
- The Campaign Shows Why Attribution Is Complicated
Shared techniques and infrastructure can strongly suggest relationships, but researchers must distinguish evidence from certainty.
40. The Biggest Lesson Is Simple
Attackers can hide their malware remarkably well—but they cannot always hide the mistakes they make while building it.
✅ Operation GitPower Uses Malicious LNK and PowerShell Techniques
The reported campaign involves ZIP archives containing malicious Windows shortcut files that trigger PowerShell activity.
This technique is consistent with the documented infection chain described by researchers.
✅ GitHub Was Used as Part of the Payload Delivery Infrastructure
The campaign reportedly retrieved scripts and payloads through GitHub’s Raw Content functionality.
That is a legitimate GitHub feature being abused as part of malicious infrastructure, rather than evidence that GitHub itself is participating in the operation.
✅ Testing Artifacts Exposed Internal IP Addresses
Researchers identified files containing addresses associated with malware testing, including 172.16.11[.]141 and 169.254.33[.]137.
These artifacts provide valuable clues into the
✅ AsyncRAT Payloads Were Disguised as Image Files
The reported samples included files with image-like names that contained encrypted .NET AsyncRAT payloads.
This demonstrates why defenders should validate file content instead of trusting extensions.
⚠️ Kimsuky Attribution Requires Appropriate Caution
The campaign is assessed by researchers as linked to Kimsuky based on observed tactics, infrastructure, malware behavior, and overlaps with previous activity.
Attribution in cybersecurity is rarely equivalent to courtroom-level proof, so assessments should be treated according to the confidence expressed by the researchers.
Prediction
(+1) Public Developer Platforms Will Become Even More Important in Threat Hunting
As attackers increasingly abuse GitHub and other legitimate cloud services, security teams will invest more heavily in behavioral detection rather than simple domain blocking.
The most effective defenses will correlate endpoint activity, identity events, network connections, repository access, and process behavior.
(+1) AI-Generated Phishing Lures Will Become More Convincing
The use of polished financial and investment documents suggests that generative AI is already influencing social-engineering operations.
Future campaigns are likely to produce highly personalized documents that closely match the victim’s industry, organization, language, and professional role.
(+1) Development Artifacts Will Become a Larger Intelligence Source
Security researchers will increasingly hunt for test files, configuration mistakes, repository history, debug logs, and other traces left behind by attackers.
These artifacts may reveal more about an operation than the final malware sample.
(-1) Traditional Endpoint Defenses Will Struggle With Trusted Infrastructure Abuse
If malicious scripts are delivered through services that organizations already trust, simple reputation-based blocking becomes less effective.
Organizations that rely heavily on allowlists without behavioral monitoring could find themselves increasingly exposed.
The Final Warning
The most important lesson from the Kimsuky-linked Operation GitPower activity is not that attackers have discovered a revolutionary new technique.
It is that ordinary technologies can become extraordinarily effective when combined carefully.
A malicious LNK file provides the initial execution.
PowerShell performs the hidden work.
A convincing PDF keeps the victim calm.
GitHub provides trusted infrastructure.
A scheduled task provides persistence.
Host profiling identifies valuable systems.
AsyncRAT provides remote access.
And public development artifacts can accidentally expose the people behind the operation.
That combination demonstrates how modern cyber espionage is becoming less dependent on noisy, obviously malicious infrastructure.
The attackers do not necessarily need to build a suspicious network.
They can borrow the
For defenders, the answer is not to distrust every PDF, block every GitHub repository, or disable every legitimate administrative tool.
The answer is to understand context.
A PowerShell process by itself may be legitimate.
A PowerShell process launched by an LNK file, creating a hidden script in AppData, establishing a scheduled task, and downloading content from GitHub is a very different story.
A PNG file may be harmless.
A PNG file that is actually an encrypted .NET payload downloaded by an obfuscated PowerShell command is something else entirely.
That distinction—between an isolated event and a connected chain of behavior—is where modern threat detection succeeds.
And in this case, the irony is striking: a campaign designed to operate quietly may have revealed some of its most valuable secrets simply because its own testing environment was not as private as its operators believed.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.facebook.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
