Phishing LNK files and GitHub C2 power new DPRK cyber attacks
ID: 8aafecb8-1e2d-5956-b954-ba4c168ceac7
STIX ID: report--8aafecb8-1e2d-5956-b954-ba4c168ceac7
Feed Name: Security Affairs
Threat Score
**DPRK-linked phishing campaign uses obfuscated LNK files and PowerShell to drop decoy PDFs, establish persistence via scheduled tasks, and use private GitHub repositories as C2 for data exfiltration and remote control, with activity focused on South Korean targets.**
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.