Kimsuky GitPower: Hunt GitHub Abuse, Don’t Block Test IPs

Cyber Press first summarized the exposed artifacts, while Genians’ underlying research supplies the detail: a GitHub upload record contained a filename resembling

. The filename matches the output format generated by a PowerShell reconnaissance script that collects an active adapter’s IP address, combines it with a timestamp, and writes system information for upload. That connects the artifact to the campaign’s collection machinery rather than merely placing a suspicious file beside it.

The important limitation is also the one missing from most retellings:

is an RFC 1918 private address. It is not routable on the public internet, cannot identify an actor’s physical location, and should not be fed into firewall blocks or threat-intelligence reputation controls. It is useful as a development-environment clue and as corroboration that the collection script was exercised, but it is not an external Kimsuky command-and-control endpoint.

The exposed addresses do not carry equal weight​

Genians also reported

in testing artifacts alongside files named

and

. Those files were reportedly RC4-encrypted .NET AsyncRAT payloads disguised as images in public GitHub repositories. Here again, the address needs careful handling:

is the Windows link-local, or APIPA, range. Systems self-assign an address in that range when they cannot obtain normal network configuration, and it is not globally routable.

That means neither

nor

is a meaningful perimeter indicator. Both are evidence of an operator-controlled or test environment only to the degree that Genians’ infrastructure logs accurately associate them with the activity. They are valuable for analysts reconstructing the actor’s workflow, but they do not give administrators an IP to block on the edge.

The public address is different. Genians says the

,

,

, and

payload variants carried

as their AsyncRAT command-and-control address. That is the one network indicator in the report that can be operationally relevant for retrospective proxy, DNS, firewall, and endpoint telemetry searches. Even then, an IP-only block is a short-lived control: the campaign’s strength is that it uses GitHub repositories and GitHub APIs for much of its delivery, check-in, and data staging, where legitimate enterprise traffic is common.

No other outlet located in this reporting independently documented the exact

upload record or the

review activity. Those particulars should therefore remain attributed to Genians rather than treated as independently confirmed facts. Fortinet’s April research does, however, independently corroborate the broader LNK-to-PowerShell-to-GitHub operating model and identified the GitHub account

among accounts used in related activity.

The Windows compromise begins with a shortcut, not an exploit​

Operation GitPower starts with a ZIP archive carrying a Windows shortcut file masquerading as a document. Genians observed lures styled as event material, payment requests, legal documents, research content, and embassy correspondence; more recent decoys included investment and virtual-asset documents that the company assesses were generated or polished with generative AI tools.

Opening the

launches an obfuscated command line, often with hundreds of leading spaces to hide the meaningful portion from the normal Windows shortcut-properties display. The command decodes an embedded PowerShell loader, writes it to

, and opens a benign-looking PDF. While the reader sees a document, the loader retrieves additional content from GitHub Raw Content and creates scripts in

.

One Genians sample used a roughly 3,800-character shortcut argument and saved an initial script as

. It then displayed a PDF named

, created an intermediate

script, and registered a hidden scheduled task named

. The task was set to begin after about five minutes and repeat every 30 minutes.

Fortinet reported a closely aligned campaign on April 2 targeting Windows users in South Korea. Its samples also used deceptive PDFs, hidden PowerShell, anti-analysis process checks, and a scheduled task configured for 30-minute recurrence. Fortinet observed the malware uploading system information through GitHub’s API and fetching follow-on commands from GitHub Raw Content. That independent overlap is stronger evidence for the campaign pattern than any one leaked filename or test address.

There is no Windows CVE or emergency patch associated with this activity. The initial execution is social engineering: a recipient opens a shortcut file. Organizations looking only at patch compliance will miss the control point. The preventive measures are attachment filtering, extension visibility, endpoint behavior rules, least privilege, and detection around child processes and persistence.

GitHub is the operational channel, not merely a download host​

The GitHub abuse is the practical concern for Windows administrators. Genians says the actor split URLs into strings to frustrate static inspection, used a hardcoded GitHub access token that has since been revoked, and repeatedly retrieved scripts and payloads from repositories. The victim device can therefore make HTTPS requests to a domain many organizations allow by default, while the attacker changes scripts, decoys, and encrypted RAT payloads without rebuilding the original phishing attachment.

That delivery architecture changes the incident-response question. Blocking a single raw-content URL might stop an observed sample, but it does not address the behavior of

launching a shortcut that starts hidden PowerShell, writes randomly named scripts under user-writable directories, registers a scheduled task, and contacts GitHub APIs to upload a host profile.

Fortinet’s earlier investigation exposed the same advantage for the operator: private repositories can hold payloads and victim data while blending activity into normal GitHub traffic. Genians’ newer material indicates that public repositories were also used to hold encrypted payloads masquerading as PNG files. Public versus private storage is an implementation detail; for defenders, the suspicious event is a workstation that has no business reason to use GitHub as an application-control channel suddenly doing so immediately after a shortcut execution.

The report’s testing record adds a notable operational detail. Genians found that

was viewed in Cursor, an AI-assisted development editor, and that the file included a GitHub API response tied to the infection-information upload. It says the log trail showed the operator verifying the upload feature with the private-address filename. The reasonable conclusion is narrow but useful: the same GitHub mechanism used to receive victim profiling data was tested in an environment whose artifacts later became visible to investigators.

What Windows security teams should search for now​

The campaign lends itself to behavior-based detection because its indicators are layered. Start with email and downloaded-archive telemetry for

files bearing document icons, double extensions such as

, or misleading description metadata. Genians documented a mismatch between an LNK’s stated document type and its real type, size, and modification data; that is an easy signal for mail gateways and sandboxing pipelines to preserve.

On endpoints, prioritize process chains in which

, an archive utility, or a mail client launches

,

,

, or a shortcut-hosted command. Long PowerShell arguments, Base64 decoding, string concatenation used to construct

or GitHub API paths, and hidden-window execution deserve correlation rather than isolated alerts.

Microsoft’s PowerShell Script Block Logging records processed script blocks as Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log when enabled. For this campaign, retaining that telemetry is more valuable than trying to identify every randomly generated

filename. Scheduled-task creation and modification events should be correlated with the creating process, task action, repetition interval, and any script path rooted in

,

,

, or other user-writable locations.

A concise hunt should include the following behaviors:

• Look for scheduled tasks created shortly after a user opens a ZIP-delivered shortcut, particularly tasks that invoke wscript.exe or PowerShell and repeat every 30 or 35 minutes.
• Investigate GitHub API PUT activity or GitHub Raw Content downloads from user workstations when the initiating process is PowerShell, VBScript, or an unknown script in a user profile.
• Inspect files with image extensions that are downloaded from code repositories but are not valid image files, especially where a subsequent .NET process or decryption routine follows.
• Review endpoint records for system profiling that collects OS version, build, boot history, network adapter data, and process lists immediately before external HTTPS uploads.
• Place Defender Attack Surface Reduction rules that block potentially obfuscated scripts into audit mode where necessary, then move validated policies to block mode; Microsoft explicitly lists obfuscated script execution and downloaded executable content among the behaviors ASR is designed to address.

The test leak helps attribution, but it does not solve it​

Genians assesses Operation GitPower as a continuation of Kimsuky’s FlowerPower-style activity, pointing to the PowerShell-heavy execution framework, long-running use of Git-based infrastructure, lure targeting, RTF-header manipulation seen in earlier campaigns, and infrastructure artifacts. Fortinet described its April activity more cautiously as DPRK-related and noted overlaps with Kimsuky, APT37, and Lazarus-style metadata rather than declaring a single definitive owner.

That distinction is worth preserving. LNK builders, PowerShell, GitHub, AsyncRAT, and even fake document metadata are reusable techniques. The case for a Kimsuky link comes from the combination of infrastructure, targeting, repeated workflows, and the lineage researchers observe across campaigns, not from any one shortcut or the use of a public code-hosting service.

For Windows administrators, the attribution label does not change the immediate response. A host that opened a document-themed

, created hidden PowerShell under

, registered a repeating task, and began contacting GitHub should be isolated and investigated as compromised. The exposed internal and link-local addresses are a reminder that attackers make mistakes; the actionable evidence remains on the endpoint process tree and in the GitHub-bound traffic they tried to make look ordinary.