Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Kimsuky GitHub staging infrastructure remains active despite disclosure

Part of the Kimsuky story · since 5 Sep 2025

Developinglatest 1 hour ago31 articles8 outlets
5 Sep · SecurityOnline first5 Apr16 Jun27 AugNowThis article31st of 31
  • Fri 5 Sep, 03:00 UTC. SecurityOnline, first report. Kimsuky APT Is Using Social Engineering and AppleSeed Malware to Spy on South Korea.
  • Mon 8 Sep, 12:50 UTC. GBHackers, its first report on the story. Kimsuky Hackers’ Playbook Uncovered in Exposed ‘Kim’ Data Dump.
  • Wed 10 Sep, 06:11 UTC. GBHackers. GitHub Abused by Kimsuky Hackers Delivering Malware Through LNK Files.
  • Mon 15 Sep, 10:25 UTC. GBHackers. Hackers using generative AI “ChatGPT” to evade anti-virus defenses.
  • Tue 16 Sep, 00:35 UTC. SecurityOnline. Kimsuky Group Weaponizes AI Deepfakes in New Spear-Phishing Campaign.
  • Fri 31 Oct, 07:31 UTC. GBHackers. Kimsuky and Lazarus Hackers Deploy New Backdoor Tools for Remote Access Attacks.
  • Mon 3 Nov, 01:01 UTC. SecurityOnline. North Korean APTs Upgrade Arsenal: Kimsuky Uses Stealthy HttpTroy, Lazarus Deploys New BLINDINGCAN RAT.
  • Wed 5 Nov, 02:30 UTC. Dark Reading, its first report on the story. Kimsuky Debuts HTTPTroy Backdoor Against South Korea Users.
  • Thu 6 Nov, 13:11 UTC. GBHackers. Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2.
  • Mon 10 Nov, 01:30 UTC. SecurityOnline. Kimsuky APT Uses JavaScript Loader and Certutil to Achieve Minute-by-Minute Persistence via Windows Scheduled Task.
  • Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
  • Tue 25 Nov, 00:50 UTC. SecurityOnline. Kimsuky APT Deploys Dual KimJongRAT Payloads, Switching Between PE/PowerShell Based on Windows Defender Status.
  • Thu 18 Dec, 09:15 UTC. The Hacker News, its first report on the story. Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App.
  • Mon 22 Dec, 00:41 UTC. SecurityOnline. North Korea’s Kimsuky Upgrades DOCSWAP Malware to Hijack Smartphones via QR Codes.
  • Mon 22 Dec, 00:41 UTC. SecurityOnline. Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK.
  • Sat 10 Jan, 16:31 UTC. Security Affairs, its first report on the story. North Korea–linked APT Kimsuky behind quishing attacks, FBI warns.
  • Thu 7 May, 23:25 UTC. dti.domaintools.com, its first report on the story. Fake Google Authenticator Chrome Extension Hits 260k Users.
  • Thu 14 May, 11:30 UTC. Securelist, its first report on the story. Kimsuky updates PebbleDash and AppleSeed with HelloDoor backdoor.
  • Fri 29 May, 06:46 UTC. The Hacker News. Kimsuky deploys HTTPSpy malware, expands toolkit for espionage.
  • Wed 3 Jun, 08:31 UTC. SecurityOnline. Kimsuky’s HttpSpy targets Korean military with fake meetings.
  • Mon 27 Jul, 15:11 UTC. SecurityOnline. Kimsuky uses backdoors to hit South Korean groupware vendors.
  • Mon 10 Aug, 14:41 UTC. The Hacker News. Kimsuky Uses Offline AI to Enhance Phishing and Malware Attacks.
  • Tue 18 Aug, 10:22 UTC. SecurityOnline. North Korean Kimsuky leverages AI to weaponise GitHub attacks.
  • Mon 31 Aug, 08:34 UTC. SecurityOnline. Kimsuky Spear Phishing Abuses Remote Control Tools.
  • Thu 10 Sep, 07:30 UTC. SecurityOnline. Kimsuky Uses AI Agent to Scale Phishing Against Finance Teams.
  • Tue 13 Oct, 07:31 UTC. SecurityOnline. Kimsuky Uses Reply Bait to Target Ukrainian Diplomats and Experts.
  • Tue 13 Oct, 21:53 UTC. Dark Reading. North Korean Hackers Target Ukraine With Reply Bait Phishing.
  • Thu 15 Oct, 21:13 UTC. Dark Reading. AI Is Making Cyberattacks Noisier, Not More Sophisticated.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Mon 2 Nov, 09:00 UTC. SecurityOnline. North Korean groups use AI to accelerate cyber operations.
  • Wed 4 Nov, 08:31 UTC. SecurityOnline. Kimsuky GitHub staging infrastructure remains active despite disclosure. This article, 31st of 31.

On 2 November 2026 researchers found that twenty-five GitHub accounts linked to the Kimsuky Operation GitPower campaign remained active, using around 120 public repositories to stage remote access software and regional phishing lures. The activity, described as live and state‑linked DPRK espionage infrastructure, persisted despite prior disclosures in October 2026.

The clearest evidence centres on the nemotomui account’s gabiaxis repository, which was used to stage customized AnyDesk remote administration packages for new victims. The operator employed an upload‑then‑delete pattern, pushing a folder containing batch files, PowerShell scripts and configuration data, then removing it from public view about thirty minutes later. VULONE tracked eight deployment cycles in this repository between 24 August and 2 November 2026, with five cycles occurring after the initial advisory.

The most recent cycle, on 2 November between 09:27 and 10:01 UTC, included updates to AnyDesk configuration parameters, private keys, certificates and password hashes.

Researchers attribute the infrastructure with high confidence to Kimsuky (TA406/APT43), a North Korea‑linked cyberespionage unit. Other corroboration comes from the Lazarus[.]day tracking portal, which indexed gabiaxis as a Kimsuky artifact, and from prior reports by Proofpoint and Digital Security Lab Ukraine describing similar account‑farm behaviours.

The campaign targeted Ukrainian diplomatic and defence specialists, South Korean citizens, and German commercial targets, with multilingual lures in Korean and German. Eight AnyDesk deployment cycles indicate multiple compromise attempts, though the public hostnames within repositories were not disclosed.

Defence guidance in the report urges behavioural detection for unusual outbound connections to code repositories, monitoring for unexpected AnyDesk installations, inspecting script interpreters from temporary or public folders, reviewing proxy logs for staging accounts and GitHub Pages domains, and blocking unapproved remote desktop tools in sensitive sectors.

How the story developed

All 31 articles
Developinglatest 1 hour ago31 articles8 outlets

31 articles from 8 outlets since 5 Sep. Still developing; the latest report was 1 hour ago. This was the 31st report, 425 days after the first.

Now5 Sep197282193 May32417526187First reportSecurityOnline · 5 Sep, 03:00This article31st of 31 · day 425
  • Fri 5 Sep, 03:00 UTC. SecurityOnline, first report. Kimsuky APT Is Using Social Engineering and AppleSeed Malware to Spy on South Korea.
  • Mon 8 Sep, 12:50 UTC. GBHackers, its first report on the story. Kimsuky Hackers’ Playbook Uncovered in Exposed ‘Kim’ Data Dump.
  • Wed 10 Sep, 06:11 UTC. GBHackers. GitHub Abused by Kimsuky Hackers Delivering Malware Through LNK Files.
  • Mon 15 Sep, 10:25 UTC. GBHackers. Hackers using generative AI “ChatGPT” to evade anti-virus defenses.
  • Tue 16 Sep, 00:35 UTC. SecurityOnline. Kimsuky Group Weaponizes AI Deepfakes in New Spear-Phishing Campaign.
  • Fri 31 Oct, 07:31 UTC. GBHackers. Kimsuky and Lazarus Hackers Deploy New Backdoor Tools for Remote Access Attacks.
  • Mon 3 Nov, 01:01 UTC. SecurityOnline. North Korean APTs Upgrade Arsenal: Kimsuky Uses Stealthy HttpTroy, Lazarus Deploys New BLINDINGCAN RAT.
  • Wed 5 Nov, 02:30 UTC. Dark Reading, its first report on the story. Kimsuky Debuts HTTPTroy Backdoor Against South Korea Users.
  • Thu 6 Nov, 13:11 UTC. GBHackers. Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2.
  • Mon 10 Nov, 01:30 UTC. SecurityOnline. Kimsuky APT Uses JavaScript Loader and Certutil to Achieve Minute-by-Minute Persistence via Windows Scheduled Task.
  • Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
  • Tue 25 Nov, 00:50 UTC. SecurityOnline. Kimsuky APT Deploys Dual KimJongRAT Payloads, Switching Between PE/PowerShell Based on Windows Defender Status.
  • Thu 18 Dec, 09:15 UTC. The Hacker News, its first report on the story. Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App.
  • Mon 22 Dec, 00:41 UTC. SecurityOnline. North Korea’s Kimsuky Upgrades DOCSWAP Malware to Hijack Smartphones via QR Codes.
  • Mon 22 Dec, 00:41 UTC. SecurityOnline. Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK.
  • Sat 10 Jan, 16:31 UTC. Security Affairs, its first report on the story. North Korea–linked APT Kimsuky behind quishing attacks, FBI warns.
  • Thu 7 May, 23:25 UTC. dti.domaintools.com, its first report on the story. Fake Google Authenticator Chrome Extension Hits 260k Users.
  • Thu 14 May, 11:30 UTC. Securelist, its first report on the story. Kimsuky updates PebbleDash and AppleSeed with HelloDoor backdoor.
  • Fri 29 May, 06:46 UTC. The Hacker News. Kimsuky deploys HTTPSpy malware, expands toolkit for espionage.
  • Wed 3 Jun, 08:31 UTC. SecurityOnline. Kimsuky’s HttpSpy targets Korean military with fake meetings.
  • Mon 27 Jul, 15:11 UTC. SecurityOnline. Kimsuky uses backdoors to hit South Korean groupware vendors.
  • Mon 10 Aug, 14:41 UTC. The Hacker News. Kimsuky Uses Offline AI to Enhance Phishing and Malware Attacks.
  • Tue 18 Aug, 10:22 UTC. SecurityOnline. North Korean Kimsuky leverages AI to weaponise GitHub attacks.
  • Mon 31 Aug, 08:34 UTC. SecurityOnline. Kimsuky Spear Phishing Abuses Remote Control Tools.
  • Thu 10 Sep, 07:30 UTC. SecurityOnline. Kimsuky Uses AI Agent to Scale Phishing Against Finance Teams.
  • Tue 13 Oct, 07:31 UTC. SecurityOnline. Kimsuky Uses Reply Bait to Target Ukrainian Diplomats and Experts.
  • Tue 13 Oct, 21:53 UTC. Dark Reading. North Korean Hackers Target Ukraine With Reply Bait Phishing.
  • Thu 15 Oct, 21:13 UTC. Dark Reading. AI Is Making Cyberattacks Noisier, Not More Sophisticated.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Mon 2 Nov, 09:00 UTC. SecurityOnline. North Korean groups use AI to accelerate cyber operations.
  • Wed 4 Nov, 08:31 UTC. SecurityOnline. Kimsuky GitHub staging infrastructure remains active despite disclosure. This article, 31st of 31.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 31 articles as a list
  1. Fri 5 SepDay 01
    1. Kimsuky APT Is Using Social Engineering and AppleSeed Malware to Spy on South Korea03:00 · SecurityOnline · First report

  2. Quiet for 3 days

    Mon 8 SepDay 31
    1. Kimsuky Hackers’ Playbook Uncovered in Exposed ‘Kim’ Data Dump12:50 · GBHackers · Picked up again

  3. Quiet for 2 days

    Wed 10 SepDay 51
    1. GitHub Abused by Kimsuky Hackers Delivering Malware Through LNK Files06:11 · GBHackers

  4. Quiet for 5 days

    Mon 15 SepDay 101
    1. Hackers using generative AI “ChatGPT” to evade anti-virus defenses10:25 · GBHackers · Picked up again
  5. Tue 16 SepDay 111
    1. Kimsuky Group Weaponizes AI Deepfakes in New Spear-Phishing Campaign00:35 · SecurityOnline

  6. Quiet for 6 weeks

    Fri 31 OctDay 561
    1. Kimsuky and Lazarus Hackers Deploy New Backdoor Tools for Remote Access Attacks07:31 · GBHackers · Picked up again

  7. Quiet for 3 days

    Mon 3 NovDay 591
    1. North Korean APTs Upgrade Arsenal: Kimsuky Uses Stealthy HttpTroy, Lazarus Deploys New BLINDINGCAN RAT01:01 · SecurityOnline · Picked up again

  8. Quiet for 2 days

    Wed 5 NovDay 611
    1. Kimsuky Debuts HTTPTroy Backdoor Against South Korea Users02:30 · Dark Reading · Picked up again
  9. Thu 6 NovDay 621
    1. Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C213:11 · GBHackers

  10. Quiet for 4 days

    Mon 10 NovDay 661
    1. Kimsuky APT Uses JavaScript Loader and Certutil to Achieve Minute-by-Minute Persistence via Windows Scheduled Task01:30 · SecurityOnline · Picked up again
  11. Tue 11 NovDay 671
    1. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices01:00 · SecurityOnline

  12. Quiet for 2 weeks

    Tue 25 NovDay 811
    1. Kimsuky APT Deploys Dual KimJongRAT Payloads, Switching Between PE/PowerShell Based on Windows Defender Status00:50 · SecurityOnline · Picked up again

  13. Quiet for 3 weeks

    Thu 18 DecDay 1041
    1. Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App09:15 · The Hacker News · Picked up again

  14. Quiet for 4 days

    Mon 22 DecDay 1082
    1. North Korea’s Kimsuky Upgrades DOCSWAP Malware to Hijack Smartphones via QR Codes00:41 · SecurityOnline · Picked up again
    2. Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK00:41 · SecurityOnline

  15. Quiet for 3 weeks

    Sat 10 JanDay 1271
    1. North Korea–linked APT Kimsuky behind quishing attacks, FBI warns16:31 · Security Affairs · Picked up again

  16. Quiet for 17 weeks

    Thu 7 MayDay 2441
    1. Fake Google Authenticator Chrome Extension Hits 260k Users23:25 · dti.domaintools.com · Picked up again

  17. Quiet for 7 days

    Thu 14 MayDay 2511
    1. Kimsuky updates PebbleDash and AppleSeed with HelloDoor backdoor11:30 · Securelist · Picked up again

  18. Quiet for 2 weeks

    Fri 29 MayDay 2661
    1. Kimsuky deploys HTTPSpy malware, expands toolkit for espionage06:46 · The Hacker News · Picked up again

  19. Quiet for 5 days

    Wed 3 JunDay 2711
    1. Kimsuky’s HttpSpy targets Korean military with fake meetings08:31 · SecurityOnline · Picked up again

  20. Quiet for 8 weeks

    Mon 27 JulDay 3251
    1. Kimsuky uses backdoors to hit South Korean groupware vendors15:11 · SecurityOnline · Picked up again

  21. Quiet for 2 weeks

    Mon 10 AugDay 3391
    1. Kimsuky Uses Offline AI to Enhance Phishing and Malware Attacks14:41 · The Hacker News · Picked up again

  22. Quiet for 8 days

    Tue 18 AugDay 3471
    1. North Korean Kimsuky leverages AI to weaponise GitHub attacks10:22 · SecurityOnline · Picked up again

  23. Quiet for 13 days

    Mon 31 AugDay 3601
    1. Kimsuky Spear Phishing Abuses Remote Control Tools08:34 · SecurityOnline · Picked up again

  24. Quiet for 10 days

    Thu 10 SepDay 3701
    1. Kimsuky Uses AI Agent to Scale Phishing Against Finance Teams07:30 · SecurityOnline · Picked up again

  25. Quiet for 5 weeks

    Tue 13 OctDay 4032
    1. Kimsuky Uses Reply Bait to Target Ukrainian Diplomats and Experts07:31 · SecurityOnline · Picked up again
    2. North Korean Hackers Target Ukraine With Reply Bait Phishing21:53 · Dark Reading

  26. Quiet for 2 days

    Thu 15 OctDay 4051
    1. AI Is Making Cyberattacks Noisier, Not More Sophisticated21:13 · Dark Reading

  27. Quiet for 2 weeks

    Thu 29 OctDay 4191
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again

  28. Quiet for 4 days

    Mon 2 NovDay 4231
    1. North Korean groups use AI to accelerate cyber operations09:00 · SecurityOnline · Picked up again

  29. Quiet for 2 days

    Wed 4 NovDay 4251
    1. Kimsuky GitHub staging infrastructure remains active despite disclosure08:31 · SecurityOnline · This article, 31st of 31

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in