Kimsuky Operation GitPower Targets Ukrainian Officials via GitHub and Codeberg

North Korea-linked threat actor Kimsuky is conducting a cyber espionage campaign named Operation GitPower against Ukrainian experts in diplomacy, security, and international policy. The group utilizes trusted code hosting platforms to deliver malware, execute remote commands, and exfiltrate sensitive data from targeted organizations.

What happened

Researchers from Genians published findings on October 12, 2026, detailing how Kimsuky combines targeted emails, counterfeit PDF files, and Windows scripts to compromise victims. The attackers use social engineering themes such as conference invitations and research feedback requests to establish trust before deploying harmful files. According to the report, the campaign relies on a distributed infrastructure across multiple code repositories.

One specific attack sequence began on August 6 with a fraudulent invitation to speak at the Korea Cyber Security Conference. The initial email contained legitimate event details and offered travel support, but included no malicious links or attachments. The attacker waited for the target to reply before sending a ZIP archive containing invitation materials. This social engineering tactic aims to bypass initial security filters by requiring user interaction.

A subsequent variation of the attack used password protection on the ZIP archive to hinder automated inspection by email security tools. Inside the archive, a legitimate-looking HTML invitation concealed a Windows shortcut file disguised as a PDF document. Opening this shortcut launches cmd.exe and uses curl to download additional files from GitLab servers. This method allows the malware to operate in the background while displaying a decoy PDF to the user.

Another approach observed on August 19 involved an impersonation of a policy researcher seeking feedback on a report regarding Russia and North Korea. After the target replied, the attacker provided a download link hosted on Codeberg. When this initial malware attempt failed, the group switched tactics in September to deploy a fake meeting login page designed to harvest account credentials. This pivot demonstrates the group's ability to adapt when primary vectors are blocked.

The initial script downloaded from GitLab retrieves a follow-up component that executes entirely in memory. To evade detection, the loader obscures PowerShell commands by inserting extra words into the code string. It then removes these words using the Replace() function immediately before execution. Genians linked these recent activities to earlier Operation GitPower attacks based on shared code, file names, and scheduled tasks.

Why it matters

The campaign highlights the increasing sophistication of threat actors in leveraging trusted third-party infrastructure for malicious purposes. By hosting payloads on GitHub, GitLab, and Codeberg, Kimsuky exploits the high trust levels these platforms hold within security perimeters. This strategy complicates traditional defense mechanisms that may whitelist traffic from known code hosting services.

Despite the technical complexity, the operational impact of this specific campaign appears limited. According to Genians, most observed attempts against Ukrainian targets were unsuccessful. This suggests that existing security controls or user awareness may have mitigated the majority of these intrusion attempts. However, the persistence of the group and its ability to pivot tactics indicate a sustained interest in these targets.

The use of password-protected archives and multi-stage delivery mechanisms shows Kimsuky is actively refining its methods to bypass static analysis. The group changes its email themes while maintaining a consistent underlying attack framework. This consistency allows defenders to track the group's evolution, but the changing surface themes require continuous monitoring of user behavior rather than just signature-based detection.

Our take on the response

• Monitor for unexpected PowerShell execution, particularly scripts that use string manipulation functions like Replace() before running commands.
• Inspect email attachments that arrive after an initial reply, as delayed delivery is a common tactic in this campaign.
• Review outbound connections to code hosting platforms like GitHub and GitLab for unusual data exfiltration patterns.
• Validate the authenticity of conference invitations and research requests through out-of-band communication channels before downloading files.

Background: Social engineering

Social engineering is the psychological manipulation of people into performing actions or divulging confidential information. It relies on trust, urgency, and authority to bypass security controls. Defenses require verifying identity through out-of-band channels and validating requests against established procedures.

Read the full guide: Social Engineering Explained: How Manipulation Bypasses Security

What to do and how to stay safe: Kimsuky

• Enforce strict email filtering rules that flag messages containing password-protected archives or requests for user replies before attachment delivery.
• Configure endpoint detection and response tools to alert on cmd.exe spawning curl or PowerShell processes, especially when initiated from user profile directories.
• Implement application control policies to prevent the execution of Windows shortcut files (.lnk) from email attachments or temporary download folders.
• Train staff to verify the legitimacy of unsolicited invitations or research requests by contacting the purported sender through official, known contact methods.

Step-by-step guide: Ransomware Backups: How Small Teams Survive Without Enterprise Budgets

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which platforms is Kimsuky using to host its malware in Operation GitPower?

The group uses GitHub for payload delivery and data transfers, GitLab for decoy documents and scripts, and Codeberg to host malicious archives.

How does the malware evade detection during execution?

The loader hides PowerShell commands by inserting extra words into the code and removes them using the Replace() function just before execution.

Did the attackers successfully compromise the Ukrainian targets?

According to Genians researchers, most observed attempts against the Ukrainian targets were unsuccessful, limiting the campaign's reported impact.