Threat intel

On October 12, the South Korean security firm Genians published a report tying a run of spear-phishing emails against Ukrainian experts in diplomacy, security, international policy and civil society to Kimsuky, a North Korean state espionage group. Genians files the activity under Operation GitPower, a name that comes from the group's habit of hosting its scripts on GitLab, GitHub and Codeberg and sending stolen data back through GitHub. The Ukrainian lures started in August 2026. Genians says most of the attempts it observed failed.

The same chain had already been documented from the victim side. On August 24, Digital Security Lab Ukraine (DSLU), a Ukrainian digital security NGO, published its investigation of an attack on a representative of a Ukrainian civil society organization, without naming an attacker. The file names, GitLab repository, folder path and scheduled task in DSLU's report match the ones in Genians' report. If your staff work on Ukraine, Russia or the Korean peninsula, in government, a think tank, a university or an NGO, this group writes emails meant for them.

How it works

The first email carries nothing a filter can score. On August 6 a sender at kcscon@proton[.]me, posing as the organiser of the Korea Cyber Security Conference (KCSCON), invited a Ukrainian security expert to speak, using real event details. A second lure proposed research cooperation in the name of an Asia specialist. Genians describes the persona as an East Asia specialist at a European policy institute, while DSLU says the sender used the name of a real, well-known Ukrainian analyst of the Asia-Pacific region and wrote from a Google account. Neither first message had a link or an attachment. The attack only moves forward once the target replies, a method known as reply-baiting.

The reply brings the payload. For KCSCON it was a ZIP holding an HTML copy of the invitation and KCSCON_2026_Official_Invitation.pdf.lnk; a later version of the archive was password protected, which keeps mail gateways from opening it. For the research lure it was a link to Аналітичний_звіт_Наталії.zip ("Natalia's analytical report") on Codeberg, a free Git hosting service. Inside is an LNK file, a Windows shortcut, with a PDF icon. Windows hides known extensions by default, so .pdf.lnk shows as .pdf.

Double-clicking the shortcut starts cmd.exe. It downloads a real PDF as a decoy and a script called first.ini from the GitLab repository kickball12/bahubali. Genians notes the download is done with curl -k -L, which skips certificate checks and follows redirects. The script is saved as C:\Users\Public\Music\apple.vbe, an encoded VBScript file, and run hidden by wscript.exe. It then fetches help.ini from the same repository and runs it in memory, so that stage never touches disk.

help.ini sets up persistence with a scheduled task named GoogleUpdateTaskMachineUA{1C791230-CA8D-6D04-AC55-E498ABE7C33} that repeats every 15 minutes. Google's own updater registers tasks with the same prefix, which is why the name blends in. On each run it collects the output of systeminfo (Windows build, patches, hardware, network settings, domain membership) and a listing of the user's Downloads folder, encodes both in Base64 and uploads them to a private GitHub repository, in a folder named after the computer. Genians says the upload goes through the GitHub Contents API with an access token written into the script. To a proxy, that traffic is ordinary HTTPS to a site developers use every day.

Genians describes a second, parallel chain. A script named update1.vbs registers a task called OneDriveUpdateScheduler that runs every minute and starts update2.ps1, a PowerShell backdoor that connects to 111.92.246[.]145 on TCP port 12345 to fetch more scripts and send back results. The same server is used by an unsigned zoominstaller.exe that the group placed in a public GitHub repository. It installs the backdoor, creates a task named Zoom-Auto-Installer, then downloads and runs the real Zoom installer so the user sees what they expected.

What attackers are doing

Genians reads the Ukrainian targeting as collection on the war that North Korea is now part of. Dark Reading, quoting the report, lists the information Kimsuky appears to be after: the war situation, the scale of North Korean military casualties, and how prisoners are being questioned and handled. Genians also notes overlap with TA406, the name Proofpoint uses for a North Korean group that phished Ukrainian government bodies from February 2025 to gauge the course of the Russian invasion. Genians bases the Kimsuky link on shared code in first.ini and help.ini, filename habits, obfuscation markers and infrastructure; it is an assessment, and DSLU names no actor.

When the malware did not land, the operators kept the thread going. Genians saw a later email in the same conversation, branded as a Google meeting request but linking to a Zoom login, send the target to security-zooma.serveirc[.]com, a fake sign-in page. Dark Reading points out the mismatch of Google and Zoom branding as one of several sloppy errors in the lures. The same toolkit was also aimed at Japanese and South Korean targets with other decoys.

What to do

At the mail gateway and proxy

1. Quarantine shortcut and script files from outside senders. In Microsoft Defender for Office 365 the setting is under Email & collaboration, then Policies & rules, Threat policies and Anti-malware; turn on the common attachments filter and check that lnk, vbe and vbs are on its list.
2. Add an Exchange Online mail flow rule with the condition "Any attachment is password protected" that routes these messages to quarantine or adds a warning banner. The later KCSCON archive depended on that encryption.
3. Codeberg and GitLab links in a reply thread deserve the same suspicion as attachments. If your proxy can tell user browsers from scripts, alert on codeberg.org and gitlab.com/*/-/raw/ downloads to staff who do not write code.
4. Block 111.92.246[.]145, security-zooma.serveirc[.]com and the full indicator lists in the Genians and DSLU reports at DNS and the firewall.

On endpoints

Set Windows to show file extensions through Group Policy, and use Windows Defender Application Control or AppLocker to stop wscript.exe and cscript.exe for users who never run scripts. That one change breaks steps 4 and 5 of the chain. Install meeting software only from your software portal; the fake Zoom installer had no valid signature.

Check whether you were already hit

On a single machine, list the tasks and look at what they run:

Get-ScheduledTask | Where-Object { $_.TaskName -match 'GoogleUpdateTaskMachineUA|OneDriveUpdateScheduler|Zoom-Auto-Installer' } |
  Select-Object TaskName, @{n='Action';e={$_.Actions.Execute + ' ' + $_.Actions.Arguments}}
Get-ChildItem C:\Users\Public\Music, C:\Users\Public -Include *.vbe, *.vbs, *.ps1 -Recurse -ErrorAction SilentlyContinue

A genuine Google task runs GoogleUpdate.exe or updater.exe from the Google folder under Program Files. A task with that name that runs wscript.exe is the implant. Across a fleet in Microsoft Defender XDR:

DeviceEvents
| where Timestamp > ago(90d)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields).TaskName),
         TaskContent = tostring(parse_json(AdditionalFields).TaskContent)
| where TaskName has_any ("GoogleUpdateTaskMachineUA", "OneDriveUpdateScheduler", "Zoom-Auto-Installer")
| where TaskContent has_any ("wscript", "powershell", "Users\\Public")

Add a process query for wscript.exe whose command line contains \Users\Public\, and a network query for RemoteIP == "111.92.246.145" or RemotePort == 12345 in DeviceNetworkEvents. Ninety days reaches back past the first lure on August 6.

If you find it

Isolate the machine and rebuild it. Assume the attacker has the host profile and the names of everything in Downloads, and read those names as the attacker would: draft reports, travel plans, contact lists. Reset the user's Google and Microsoft passwords, since the follow-up phishing page was built to take them, and move people who handle sensitive Ukraine or Korea work to phishing-resistant sign-in with passkeys or security keys; Google's Advanced Protection Program covers personal Gmail accounts too. Then tell the people the attacker impersonated, and anyone else who may have received the same invitation.

We build those controls in safeguarding and hardening work and write and tune hunts like the ones above in security operations. If you want to know whether your estate would catch GitPower, open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Genians Security Center, Digital Security Lab Ukraine, Dark Reading, Gridinsoft, Cyberpress, GBHackers, The Record.