GENUINELY , North Korea-linked actor Kimsuky has been observed conducting a reply‑baiting spear‑phishing campaign aimed at Ukrainian diplomacy, security professionals and international policy experts, under the umbrella of Operation GitPower. Beginning in August 2026, the operators sent emails that asked recipients to engage in a conversation rather than immediately delivering malware.
One lure claimed the recipient had been selected as a speaker at the 14th Korea Cyber Security Conference (KCSCON 2026) in Seoul, including purported details of the schedule, venue and topics, but the sender used a Proton Mail address rather than the organiser’s domain. A second lure targeted an international policy expert, requesting input on a Russia–North Korea military ties report; when the target replied, a download link arrived about two hours later.
In subsequent waves, targets received ZIP archives containing shortcut (LNK) files masquerading as PDFs, with some archives password‑protected to hinder scanning. Opening the LNKs triggered a script fetched from GitLab, displaying decoy PDFs while setting up a scheduled task that impersonated a Google update, harvesting system details and a Downloads listing, and exfiltrating data to attacker‑controlled GitHub repositories via the GitHub API.
A later tactic included a fake Zoom installer posted on GitHub, which installs a PowerShell backdoor, and other LNK lures pretended to be a Russia‑Ukraine peace plan or a researcher’s CV. Genians ties these techniques to Kimsuky through file names, code structure and obfuscated strings such as “first[.]ini” and “help[.]ini,” and the use of the junk string “wolf.”
The campaign’s impact appears limited: Genians reports most observed attempts were unsuccessful and provides no victim counts or confirmed data losses. Nevertheless, the ongoing activity—with GitHub, GitLab and Codeberg as data‑staging channels—suggests the toolkit may be repurposed against new Ukrainian or international targets.
Defenders are urged to treat speaker invitations with scepticism, verify sender identities via official channels, monitor for LNKs and unusual scheduled tasks, and implement phishing‑resistant MFA to blunt forged login pages.