Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower

Genians links a spear-phishing campaign (Operation GitPower) to North Korea–linked Kimsuky that used reply-baiting emails to engage Ukrainian diplomacy and security experts, then delivered malicious LNK shortcuts, passworded archives, and fake Zoom installers hosted on public code platforms to run PowerShell backdoors, collect system data, and exfiltrate files via GitHub/GitLab APIs; vendor attribution cites matching filenames, code patterns, and reused strings from prior Kimsuky activity, though most observed attempts reportedly failed.