North Korea’s Kimsuky group has been courting Ukrainian policy and security experts with convincing speaker invitations and research review requests, only sending malware once the target replies. It leans on GitHub, GitLab and Codeberg to stage payloads and exfiltrate data, and the same playbook would work against the UK’s own think tanks, universities and defence-policy community.
What happened
South Korean security firm Genians published research on 12 October 2026 attributing a new wave of spear-phishing to Kimsuky, the long-running North Korean espionage group. The activity sits within a wider operation Genians calls Operation GitPower, and this time the targets were Ukrainian specialists working on diplomacy, security, international policy and civil society. The Record reported the findings on 13 October.
Two approaches stand out. On 6 August, an attacker posing as an organiser of the 14th Korea Cyber Security Conference (KCSCON 2026), held in Seoul, invited a Ukrainian security expert to speak. The email used the event’s genuine schedule, venue and themes, and dangled flights, a hotel and a speaking fee. On 19 August, a second lure came from someone claiming to be an East Asia specialist at a European research institute, asking for comments on a paper about how Moscow and Pyongyang are working together militarily.
Neither first email carried a link or attachment. The payload arrived only after the recipient answered. Genians notes that the fake conference invitation was sent from a Proton Mail account rather than the organiser’s own domain. When one malware attempt failed, the operators came back roughly four weeks later with a fake meeting invitation pointing at a lookalike login page built to harvest credentials.
Genians says most of the attempts it observed did not succeed and has not published victim numbers. It suggests the intelligence goals include North Korean troop losses in Russia’s war, how prisoners of war are being handled, and talks between Seoul and Kyiv.
The technical picture
Once a target engages, they receive a ZIP archive, in later versions password protected, which makes it harder for mail gateways to inspect. Inside is a Windows shortcut (LNK) file with a PDF icon and a double extension. Opening it launches the command shell and uses curl to pull content from GitLab, shows a decoy document, and saves and runs a VBScript-encoded stage in the background.
That stage fetches a follow-up script that runs in memory. It creates a scheduled task named to look like a Google update, which fires every 15 minutes, collects system details and the contents list of the Downloads folder, then pushes them to a GitHub repository the attackers control, authenticating with a token baked into the script. September variants, themed as a peace proposal and a CV, fetched later stages from innocuous-looking GitHub files, created a OneDrive-themed task and talked to a separate command server.
An unsigned counterfeit Zoom installer, hosted openly on GitHub, quietly installs a PowerShell backdoor, then runs the genuine Zoom setup so the victim sees exactly what they expected. Genians bases its attribution on shared file names, code structure, obfuscation habits and exfiltration methods carried over from earlier GitPower activity, and cites Proofpoint research tying Kimsuky to the overlapping TA406 and Konni clusters. That is a vendor assessment rather than a government finding.
Why it matters for UK organisations
None of the reporting names a British victim, and the UK framing here is my own professional reading rather than a claim from the sources. But the profile of who was targeted maps closely onto a community the UK has in abundance: think tanks, university departments, defence and security consultancies, NGOs and civil servants who work on Ukraine, Russia and the Korean peninsula. Kimsuky has a long record of targeting think tanks, academics and media well beyond Asia.
These organisations are often small, have thin security teams and rely on people who are paid to say yes to conference invitations and peer review requests. The reply-first technique is designed for that culture. A plain, friendly email with no link gives a mail filter nothing to judge.
The use of GitHub, GitLab and Codeberg matters too. Many UK organisations allow those domains without question because developers and researchers need them. Blocking them outright is seldom realistic.
Expert view
When we run social engineering exercises, the most effective pretexts are rarely the clever ones. They are the ones that flatter the recipient and match their normal working week. A speaker slot at a respectable overseas conference with expenses paid, or a request to review a paper in your own field, ticks both boxes. Kimsuky clearly understands this, and the patience shown here, building rapport before sending anything malicious and returning weeks later with a different angle, is what separates a state operator from a commodity phishing crew.
In my experience, the technical chain is the weaker part of this operation, and that is good news for defenders. LNK files spawning cmd.exe and curl, hidden PowerShell, and scheduled tasks pretending to be Google, OneDrive or Zoom updaters are all things a reasonably tuned endpoint tool should catch. The gap is usually that small research organisations either have no endpoint detection or nobody watching its alerts. And a genuine installer screen proves nothing.
I would also caution against treating this as a story only about North Korea. Other state-backed groups use similar reply-baiting and fake-event approaches, and UK policy circles are a familiar target. The defences are the same.
What to do now
- Brief the people most at risk. Staff who work on Ukraine, Russia, North Korea or wider defence policy should know that unsolicited invitations and review requests are a favoured state lure. Check senders independently through the organiser’s official website or a known phone number, and be wary of free webmail addresses claiming to represent institutions.
- Stop shortcut files at the gateway. Block or quarantine LNK files in email and in archives, and treat password-protected archives from unknown senders as suspicious. Turn on file extension display on Windows so double extensions stand out (Cyber Essentials: secure configuration).
- Hunt for the behaviours. Alert on shortcut files launching cmd.exe, curl or PowerShell, and look for frequently repeating scheduled tasks that masquerade as Google, OneDrive or Zoom updaters. Watch for scripts on user machines calling the GitHub or GitLab APIs (Cyber Essentials: malware protection).
- Control software installation. Install meeting clients and other tools only from official sources or a managed software catalogue, and check digital signatures. Remove local admin rights from everyday accounts (Cyber Essentials: user access control).
- Use phishing-resistant MFA. The fallback lookalike login page relies on stolen passwords. FIDO2 security keys or passkeys blunt that route, especially for email and cloud collaboration accounts.
- Load the indicators. Add the hashes, domains and sender addresses Genians has published to mail and endpoint tooling, and search recent logs.
Bottom line
Operation GitPower is not technically advanced, but it is well targeted and patient. The reply-first approach gets past email filters, and abusing trusted code platforms makes the traffic look ordinary. For UK think tanks, universities and consultancies working on the war in Ukraine, the practical takeaway is to treat flattering invitations as a security event and make sure someone is actually watching endpoint alerts.
Sources
- Genians Security Center: Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War
- The Record: North Korean hackers target Ukrainian experts for possible intelligence on Russia’s war
- SecurityOnline: Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower
- Cyber Security News: Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data
