The PolySwarm Blog

Verticals Targeted: Policy Organizations, Academia, International Cooperation Organizations, Diplomatic Missions, Military, Security, Security Research, Virtual Assets
Regions Targeted: South Korea
Related Threat Actors: Kimsuky

Executive Summary

Researchers identified a continuation of the North Korean Kimsuky cyber espionage campaign, designated Operation GitPower, which combines established spear-phishing techniques with emerging artificial intelligence capabilities. While the campaign continues to rely on malicious LNK files, PowerShell loaders, and GitHub-hosted C2 infrastructure, investigators also uncovered evidence that the threat actor has deployed local large language model (LLM) environments, retrieval-augmented generation (RAG), AI development frameworks, and speech-to-text tools. The findings suggest Kimsuky is systematically building AI-enabled operational capabilities to support future espionage activities rather than merely experimenting with generative AI.

Related Families: GoBear, Troll Stealer, BetaSeed, Endor
Verticals Targeted: Government 

Executive Summary

North Korea nexus threat actor group Velvet Chollima was observed using a new Linux backdoor, dubbed Gomir, to target entities in South Korea.

Verticals Targeted: Think Tanks, Media, Government

Executive Summary

In early 2022, the North Korean threat actor group Kimsuky targeted a South Korean think tank and media entities. In this campaign, they leveraged what is known as the GoldDragon backdoor and associated C2 cluster.

Key Takeaways