Kimsuky Adopts OpenCode AI for Decoys in GitHub PAT-Based LNK Campaigns

Summary

The Kimsuky threat group is advancing its Operation GitPower campaign by using AI agents such as OpenCode to generate large volumes of convincing decoy documents. The attack chain relies on malicious LNK files delivered inside ZIP archives to launch obfuscated PowerShell loaders. These loaders abuse GitHub Personal Access Tokens (PATs) and Pastebin for command-and-control (C2) and payload delivery.

Investigation

The investigation examined 13 malicious LNK variants and 29 decoy documents, revealing recurring use of AI-generated content and headless browser automation. Researchers also identified several analysis-evasion techniques, including process blocklisting and sandbox username checks. The campaign has additionally shifted from mainly diplomatic lures toward financial and corporate-themed decoy documents.

Mitigation

Defenders should strengthen EDR-based monitoring for anomalous LNK file activity and suspicious PowerShell execution patterns. Organizations should also detect unauthorized use of GitHub PATs and connections to Pastebin for raw content delivery. Monitoring for hidden scheduled tasks that imitate legitimate system services can further reduce the risk of persistence.

Response

If malicious activity is detected, responders should correlate LNK execution with immediate PowerShell child processes and outbound connections to GitHub or Pastebin. Command lines should be reviewed for excessive length, unusual leading spaces, and custom arithmetic decoding routines. Affected endpoints should be isolated and checked for unauthorized scheduled tasks or temporary PowerShell scripts in %AppData% and %TEMP%.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary delivers a phishing email containing a file named Google Chrome.lnk. When the user clicks it, the LNK file executes a command that calls powershell.exe. To deceive the user and attempt to hide the command from simple log analysis, the LNK file’s target includes a long string of spaces followed by a reference to the legitimate Chrome executable path, and finally the malicious payload. This matches the specific detection logic looking for powershell.exe, the Chrome path, and the massive whitespace block.

• Regression Test Script:

  # Simulation Script: Create a malicious LNK file that triggers the detection
  $WshShell = New-Object -ComObject WScript.Shell
  $ShortcutPath = "$env:TEMPGoogle Chrome.lnk"
  $TargetDir = "C:Program FilesGoogleChromeApplication"
  
  # Construct the obfuscated command line
  # Note: We use many spaces to match the 'selection_spaces' requirement in the Sigma rule
  $Spaces = " " * 250
  $MaliciousCommand = "powershell.exe $Spaces `"$TargetDirchrome.exe" -Command "Write-Output 'Malicious Payload Executed'""
  
  # Create the LNK file
  $Shortcut = $WshShell.CreateShortcut($ShortcutPath)
  $Shortcut.TargetPath = "powershell.exe"
  $Shortcut.Arguments = "$Spaces `"$TargetDirchrome.exe" -Command "Write-Output 'Malicious Payload Executed'""
  $Shortcut.IconLocation = "$TargetDirchrome.exe, 0"
  $Shortcut.Save()
  
  Write-Host "Malicious LNK created at: $ShortcutPath"
  Write-Host "Executing LNK to trigger detection..."
  
  # Execute the LNK
  Start-Process $ShortcutPath

• Cleanup Commands:

  # Cleanup Script
  Remove-Item "$env:TEMPGoogle Chrome.lnk" -ErrorAction SilentlyContinue
  Write-Host "Cleanup complete."