operation gitpower

{"summary":"Operation GitPower is a threat cluster tied to the Kimsuky group, as reported by Genians Security Center in August. Windows defenders should treat its exposed artifacts as hunting leads rather than network blocklist entries. The operation uses malicious .lnk shortcuts, hidden PowerShell, scheduled-task persistence, and GitHub-hosted payload delivery. Notably, it does not rely on a newly disclosed Windows flaw but shows evidence of host-profiling and GitHub-upload workflows tested by the operators. For Windows security teams, this tag highlights the importance of monitoring GitHub abuse and focusing on behavioral detection rather than simply blocking test IPs, as the infrastructure may be reused or adapted."} {"meta_description":"Operation GitPower: Kimsuky's GitHub abuse, .lnk shortcuts, PowerShell, and persistence. Windows defenders should hunt, not block."}