Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure

A sophisticated spearphishing campaign targeting South Korea has been uncovered, utilizing GitHub as attack infrastructure. The threat actor, linked to the North Korean group Kimsuky, created multiple private repositories to store malware, decoy files, and exfiltrated victim data. The attack leveraged GitHub Personal Access Tokens to access private repositories and distribute XenoRAT malware. The campaign also employed Dropbox for malware distribution. The attackers used tailored decoy documents and impersonated legitimate entities to increase the effectiveness of their phishing attempts. Analysis of the infrastructure and malware samples revealed connections to previous Kimsuky operations, including shared test IP addresses and similar malware build environments.

• June 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-07-24
• Disclosing new PebbleDash-based toolsMalware2026-05-14
• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• July 2026 Threat Trend Report on APT Attacks (South Korea)Campaign2026-08-28
• Integrating AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLMMalware2026-08-10