Kimsuky Hackers Abuse GitHub and GitLab to Target Ukrainian Security Experts

Kimsuky (North Korea-linked) ran "Operation GitPower," a targeted phishing campaign against Ukrainian diplomacy, security, and policy experts that abused legitimate dev platforms (GitHub, GitLab, Codeberg). Attackers used reply-baiting spear-phishing, ZIP archives containing LNK shortcuts disguised as PDFs that launch cmd.exe to download VBE/PowerShell payloads, created scheduled tasks for persistence, collected system and file listings, and exfiltrated results via the GitHub Contents API; the report includes C2 IOCs (e.g., 111.92.246.145:12345) and notes most observed attempts were unsuccessful.