North Korean Hackers Abuse GitHub to Spy on South Korean Firms

FortiGuard Labs reports a high-severity North Korean espionage campaign targeting South Korean companies that uses LNK shortcut files and native Windows utilities (PowerShell, VBScript, scheduled tasks) to execute hidden scripts, avoid detection, and exfiltrate system information via legitimate GitHub repositories; attributed to groups such as Kimsuky, APT37 or Lazarus, the campaign emphasizes living-off-the-land TTPs and covert persistence rather than overt malware.