Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War

◈ Key Findings

  • Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policy
  • Spear phishing designed to elicit replies through purported international conference invitations and requests for analytical collaboration
  • Continued abuse of legitimate development platforms to distribute malware and exfiltrate information as part of Operation GitPower
  • Links to earlier CHM attack tactics identified in malicious LNK files and malware disguised as Zoom installers
  • Possible state-sponsored cyber espionage targeting developments in cooperation between South Korea and Ukraine
  • Need to strengthen EDR detection and threat hunting for the abuse of LNK files, PowerShell, and GitHub

 

Article Link: Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War