Kimsuky Expands Attack Operations with AI and Local LLMs

SOC Prime Team

Kimsuky Expands Attack Operations with AI and Local LLMs

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

The Kimsuky group is advancing its attack operations by incorporating generative AI into social engineering and deploying local Large Language Model (LLM) environments for malware development. The group uses AI-generated decoy documents to make spear-phishing campaigns more convincing. It also abuses Git-based repositories as command-and-control (C2) infrastructure for payload distribution and management of stolen data.

Investigation

Genians Security Center tracked the activity as Operation GitPower, identifying its evolution from the earlier FlowerPower campaign. The investigation revealed the use of local LLM tools such as Ollama, GPT4All, and Msty to research attack automation and RAG (Retrieval-Augmented Generation) for analyzing stolen documents. Researchers also uncovered GitHub-based C2 communication and North Korean linguistic patterns within command logs.

Mitigation

Organizations should strengthen behavior-based EDR detection focused on malicious use of LNK files, PowerShell, and legitimate cloud services such as GitHub. Security teams should monitor unusually long command-line arguments embedded in LNK files and unauthorized access to the GitHub Raw Contents API. Controls should also detect custom Base64 decoding routines and execution of hidden PowerShell scripts.

Response

If suspicious activity is detected, security teams should correlate sequences involving LNK execution, subsequent PowerShell processes, and scheduled task creation. Investigations should include identifying unauthorized Personal Access Tokens (PATs) and encrypted payloads disguised as common image files. Responders should also examine scheduled tasks for persistence and review communications with Git-based infrastructure.

Attack Flow

Proof of Value

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

Attack Narrative & Commands: The attacker has delivered a malicious .lnk file via a phishing email. When the user clicks the link, the LNK file executes a command that calls powershell.exe. To hide the payload, the attacker uses the -EncodedCommand flag, passing a Base64 encoded string that performs a simple system information gathering task. This simulates the Kimsuky group’s methodology of using LNK files to conceal the initial stages of an infection.

Regression Test Script:

# Simulation of an obfuscated PowerShell command via LNK-style execution
# The following Base64 string decodes to: Write-Host "Detection Test: Malicious Payload Simulation"
$encodedCommand = "V3JpdGUtSG9zdCAiRGV0ZWN0aW9uIFRlc3Q6IE1hbGljaW91cyBQYXlsb2FkIFNpbXVsYXRpb24i"

# Simulating the execution as if called by a shortcut (LNK)
Start-Process "powershell.exe" -ArgumentList "-EncodedCommand $encodedCommand"

Cleanup Commands:

# No persistent files are created by this simulation, but we stop any orphaned processes if necessary.
Get-Process powershell | Where-Object {$_.CommandLine -like "*Detection Test*"} | Stop-Process -Force

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Proof of Value