Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policy

Kimsuky has launched a spear phishing campaign targeting Ukrainian diplomatic and security experts using social engineering tactics like fake conference invites and collaboration requests. The campaign, called GitPower, leverages legitimate development platforms (GitHub) to distribute malware and exfiltrate data. Attack vectors include malicious LNK shortcut files and counterfeit Zoom installers, continuing tactics from earlier CHM-based attacks. The operation is attributed to state-sponsored espionage aimed at monitoring cooperation between South Korea and Ukraine. Defensive recommendations include improving EDR detection and threat hunting focused on LNK file execution, PowerShell misuse, and suspicious GitHub communications.

This campaign enables espionage actors to gain unauthorized access to sensitive information related to diplomatic, security, and international policy matters involving Ukraine. The use of legitimate platforms for malware distribution complicates detection and increases the risk of successful data exfiltration. The targeted nature of the attacks poses a medium risk to affected individuals and organizations due to potential compromise of confidential communications and strategic information.

No official patch or fix is applicable as this is a threat campaign rather than a software vulnerability. Organizations should enhance endpoint detection and response (EDR) capabilities to detect suspicious LNK file executions and PowerShell abuse. Threat hunting should focus on identifying unauthorized or unusual GitHub communications. Users should be cautious of unsolicited conference invitations and collaboration requests, especially those involving file downloads or links. Implementing user awareness training on spear phishing tactics is recommended.