Kimsuky Uses Fake Zoom Installers and Malicious LNK Files to Deploy Malware

Kimsuky’s Operation GitPower targets Ukrainian diplomacy and policy experts with reply-baiting spear-phishing that delivers ZIP archives containing decoy documents and malicious LNK files, fake Zoom installers, and staged PowerShell/VBS loaders hosted on public code platforms; the campaign establishes persistence via scheduled tasks, performs data collection and exfiltration to attacker-controlled repositories/C2 servers, and includes observable IOCs (IPs and MD5s) for detection and response.