Researchers have uncovered operational artifacts linked to a suspected Kimsuky campaign that expose how the threat actor tested malware, handled infected-host data, and used public code repositories as command-and-control infrastructure.
The findings are part of an ongoing activity cluster tracked as Operation GitPower, which researchers assess continues Kimsuky’s earlier FlowerPower-style use of malicious Windows shortcut files, PowerShell, and Git-based services.
The campaign targets policy, academic, diplomatic, international-cooperation, and security-related organizations through spear-phishing emails.
Victims receive ZIP archives containing malicious LNK shortcut files disguised as legitimate documents, including event materials, payment forms, legal files, research documents, and embassy correspondence.
In newer cases, the decoys included polished finance, virtual-asset, and investment documents that appear to have been produced with generative AI.
When a victim opens the LNK file, an obfuscated PowerShell command runs in the background. The malware displays a legitimate-looking PDF to reduce suspicion while downloading additional scripts and payloads from GitHub’s Raw Content service.
It then creates hidden PowerShell files in temporary or AppData folders and establishes persistence through a scheduled task that runs at regular intervals.
Kimsuky Testing Artifacts Exposed
One of the clearest operational security failures involved an internal IP address left in artifacts associated with the campaign.
Researchers found a GitHub upload record for an infection-information file named 172.16.11[.]141-0313_0319-0956_info.txt, exposing a private network address that appears to have been used in the actor’s test environment.
The filename matched the format produced by the campaign’s host-profiling script. The script collects the IP address of an active network adapter, adds a timestamp, and creates a text file containing system details.
These details include the operating system version, architecture, system configuration, installation and boot history, and running processes.
The collected data helps the operator identify compromised systems and decide what actions to take next. Investigators also identified the link between the testing artifact and a file named Test-com1.json, which was reviewed using the Cursor AI development tool.
The log evidence indicates the operator checked whether the infection-information upload feature was functioning correctly before or during operational use.
This overlap between development activity and live infrastructure exposed information that would normally remain hidden from defenders.
A separate artifact included the IP address 169.254.33[.]137, observed in malware testing alongside files masquerading as images.
The files, including apple.png and rabbit.png, were actually RC4-encrypted .NET AsyncRAT payloads stored in public GitHub repositories. Other payload variants used 112.216.9[.]171 as a command-and-control address, genians said.
Indicators of Compromise
| IOC type | Indicator | Description |
|---|---|---|
| C2 IP address | 112.216.9[.]171 | AsyncRAT command-and-control address embedded in fox.png, leopard.png, lion.png, and wolf.png payload variants |
| Testing IP address | 169.254.33[.]137 | IP address observed in the threat actor’s testing artifacts |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
