Verticals Targeted: Policy Organizations, Academia, International Cooperation Organizations, Diplomatic Missions, Military, Security, Security Research, Virtual Assets
Regions Targeted: South Korea
Related Threat Actors: Kimsuky
Executive Summary
Researchers identified a continuation of the North Korean Kimsuky cyber espionage campaign, designated Operation GitPower, which combines established spear-phishing techniques with emerging artificial intelligence capabilities. While the campaign continues to rely on malicious LNK files, PowerShell loaders, and GitHub-hosted C2 infrastructure, investigators also uncovered evidence that the threat actor has deployed local large language model (LLM) environments, retrieval-augmented generation (RAG), AI development frameworks, and speech-to-text tools. The findings suggest Kimsuky is systematically building AI-enabled operational capabilities to support future espionage activities rather than merely experimenting with generative AI.
Key Takeaways
- Operation GitPower demonstrates Kimsuky's continued use of spear phishing, malicious LNK files, PowerShell loaders, and GitHub-based C2 infrastructure while expanding its AI capabilities.
- Researchers identified evidence that the threat actor has established local AI environments using Ollama, GPT4All, Msty, RAG, and AI development frameworks to support future cyber espionage operations.
- AI-generated decoy documents indicate Kimsuky is leveraging generative AI to produce more convincing phishing lures while maintaining its established intrusion techniques.
- The campaign reinforces the need for behavior-based detection focused on execution chains, persistence mechanisms, PowerShell activity, and cloud-hosted C2 infrastructure as AI-assisted tradecraft continues to evolve.
Background
Operation GitPower represents an evolution of Kimsuky's long-standing cyber espionage operations rather than a significant shift in intrusion methodology. The campaign, detailed by Genians Security Center, retains many of the group's established tactics, including targeted spear-phishing emails, malicious LNK files, obfuscated PowerShell execution, scheduled task persistence, and GitHub-hosted infrastructure. However, investigators identified extensive evidence indicating that the operators are investing in AI technologies designed to improve operational efficiency across multiple stages of the attack lifecycle.
Rather than developing proprietary AI models, Kimsuky appears to be integrating publicly available AI technologies into its existing workflow. Researchers observed local LLM platforms, RAG implementations, AI agent frameworks, speech recognition tools, and commercial AI integration libraries within infrastructure associated with the campaign. These findings indicate the group is building an internal ecosystem capable of accelerating malware development, document analysis, phishing content creation, and post-compromise intelligence processing while reducing reliance on externally hosted AI services.
Technical Analysis
Initial Access and Social Engineering
Operation GitPower begins with spear-phishing emails distributing ZIP archives containing malicious Windows shortcut (LNK) files disguised as legitimate business documents. Researchers observed lures themed around government correspondence, research materials, embassy communications, financial documents, legal agreements, and international events. Executing the LNK file launches a heavily obfuscated PowerShell loader while simultaneously displaying a legitimate document to reduce user suspicion.
Researchers also observed a notable increase in AI-generated decoy documents. Rather than relying exclusively on previously stolen documents, the threat actor appears to be creating convincing phishing lures using generative AI. Metadata, document structure, formatting consistency, and template characteristics suggest automated document generation workflows designed to rapidly produce realistic financial, investment, and business-themed content that increases victim trust.
GitHub-Based C2 Infrastructure
Following execution, PowerShell scripts establish persistence through scheduled tasks before retrieving additional payloads from GitHub repositories. The attackers leverage GitHub Raw Content services and encrypted payloads disguised as image files to deliver malware while blending malicious traffic with legitimate cloud service activity. Researchers identified AsyncRAT payloads encrypted and stored within repositories using filenames resembling benign images, allowing the infrastructure to function as both a malware repository and C2 platform. The campaign further employs extensive obfuscation techniques, including Base64 encoding, string splitting, custom decoding routines, fragmented URLs, and hidden PowerShell execution to complicate static detection and forensic analysis.
AI Capability Development
The most significant finding within Operation GitPower is not the use of AI-generated phishing content, but evidence that Kimsuky is actively building an internal AI development environment. Researchers identified installations of Ollama, GPT4All, and Msty, indicating the operators established multiple local LLM execution platforms capable of operating without transmitting prompts or sensitive information to external AI providers.
Additional evidence showed the deployment of GPT4All's LocalDocs feature, which enables retrieval-augmented generation (RAG). Rather than relying solely on a model's pretrained knowledge, RAG allows AI systems to answer questions using organization-specific documents supplied by the operator. Researchers also discovered databases, model configuration files, AI agent development frameworks, Microsoft Semantic Kernel components, LangChain libraries, OpenAI integration packages, GPU acceleration libraries, and speech-to-text tooling based on Whisper. Collectively, these artifacts suggest Kimsuky is preparing to integrate AI into malware development, intelligence analysis, automation, and operational decision-making rather than conducting isolated experiments.
Who is Kimsuky?
Kimsuky is a North Korean state-sponsored advanced persistent threat (APT) group widely associated with the Reconnaissance General Bureau (RGB). Active for more than a decade, the group primarily conducts cyber espionage operations in support of North Korean strategic intelligence requirements. Its operations have historically focused on government agencies, diplomatic organizations, military institutions, policy researchers, academia, international organizations, security researchers, and more recently the virtual asset sector.
Kimsuky emphasizes long-term intelligence collection through highly targeted social engineering campaigns, credential theft, living-off-the-land techniques, PowerShell-based malware, cloud service abuse, and persistent access to victim networks. Operation GitPower demonstrates that while the group's strategic objectives remain consistent, it continues to modernize its tooling by incorporating artificial intelligence into its operational workflow.
Analyst Commentary
Operation GitPower reflects a meaningful evolution in Kimsuky's tactics, techniques, and procedures (TTPs). The group's core intrusion methodology remains largely unchanged, continuing to rely on spear phishing, malicious LNK files, PowerShell execution, GitHub-based C2 infrastructure, and living-off-the-land techniques. However, the integration of local large language models, retrieval-augmented generation, AI agent frameworks, and speech-to-text technologies represents a significant upgrade to the supporting tradecraft surrounding those established techniques.
Rather than replacing proven attack methods, these capabilities could allow Kimsuky to execute them more efficiently and at greater scale. AI-assisted workflows may accelerate phishing content creation, streamline malware development, automate the analysis of stolen information, and reduce the time required to modify tools and adapt campaigns. The use of local AI environments may also provide greater operational control by reducing reliance on externally hosted services and keeping potentially sensitive data within actor-controlled infrastructure.
This represents an important TTP shift for Kimsuky: the group appears to be moving toward an AI-augmented operational model in which established espionage techniques are supported by increasingly automated development and intelligence-processing workflows. Future campaigns may therefore evolve more rapidly while continuing to rely on familiar initial access, execution, persistence, and C2 behaviors.
For defenders, this increases the importance of rapidly identifying new and modified malware as adversaries shorten development and iteration cycles. PolySwarm's crowdsourced threat detection marketplace enables organizations to analyze suspicious files across a diverse ecosystem of commercial and specialized detection engines, helping surface malicious verdicts and emerging threats that may not yet be consistently identified by traditional security products. PolySwarm's threat intelligence capabilities can also help defenders track malware families, related samples, and evolving detections as threat actors such as Kimsuky continue to refine their tooling.
As AI lowers the cost and time required to modify malicious code and supporting infrastructure, defenders should avoid relying solely on static indicators or the apparent quality of phishing content. Combining behavioral detection with broad malware analysis and continuously updated threat intelligence provides greater resilience against campaigns in which the underlying TTPs remain recognizable even as payloads and operational tooling evolve.
IOCs
PolySwarm has multiple samples associated with this campaign.
981dadc1a7ab50d6ff600a69c904a350fcc2d2050ac94589321f51ac5527c78d
18fa10ff013cf82974f00875e23dae48d4d2dc0993a348f8069dd32845de39a1
a4f72ce8b5736fe3ca2083cfe21bd51697f12e900e307c357cb8523b8f86e3ec
9be8f2be7ad882e8423c269a0540b7c73d6470311ddfcfcd318ff9d1983e2935
2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e
d185c71b58b1ebed730feb8bbb6568d80542d2b8228b2777d280a7a4b114fdd0
018c31af135a0bc5e068df26d866440b28164aa4a659ea7df47bcbaab4a898cd
a40a61e54be9cc1671ea6832fef8139ce811a7d759058bb8b4ca86863f4cc1bd
4d37b4ccd6e4c0c9de82e66e40dfb6412b92ea33bcf10442a290b0732eeadae0
863f1405a190e2d87f06c5a9383b91b660bf4a0cd1b7c1c4987a071ee1c7dbb1
24dd215bb0946dde131f8fd0a3cc4d9ab6c095c31f8b57fb62462105e9e57cc0
456ed6926b706c203ac65b5174ac2ce78a5dad2ef0f083ae1f0aedd75d811ca2
4453b9e985f452365995c399f5292c92764570f03e6a066d7845320dd4ad09a1
b50422ec3a98d098bb3f7d728012da7e1795221c8b0624562568dff87ab5de2a
9d50b542ddc7f46aba4c621c503495ed7992d84f92fd89cbb240963636ae19d3
4b0358c7e4afa54bc489a6199cca132b5f4a330892eb15bf06c0c4da9e020df2
70a7f0aeda59f8563031b5ab4554b52f32118a96d197871181aca4ba91168cff
22180919f562fb9f6e50d7f20b2eb3f94eb009c212b74b45cf77659fe8274d5b
e49399502d455dbd38f1140bffa761701608526aefb7174646c2f8ffe881ae73
216ef271db7a1fe301bc4ca8cafb3849e4db57ff05a4bc6c146c13a026c6aa9c
0432ae814945633b605c77d137bef96c7f84934c682aada69baa326dce781286
7bc61d1bbc90d66d9988fd3baacd7834b1d2dfefe6d4ac999a194bccb9ba7dfc
531aacc5cfe1abb14aaf55a2128940db30c63cbc8d5f9846ff8608e566fecb88
5b1f75205cb79a8c8a3d8083f34b552852dfd567dd65763183b7536a29f55f5b
e34d73a1da492c9a79a9729f2f7d9d4b5a2448f44934bd5552bd0bbbe1586767
5daf3d123d58bc15e7b3130bc7c33d29b422b6aa485c67f69fbe0ed0ea95d27f
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
