Kimsuky, also tracked as APT43, continued operating the GitPower campaign through GitHub after public disclosure, with all 25 accounts examined by OctoProbe still online on November 3, 2026. Repositories served as command dead drops, collected system reports from compromised computers, distributed shortcut-based lures, and staged a preconfigured AnyDesk remote-access kit updated on November 2. Reused operator emails, usernames, code templates, task names, and infrastructure linked the account farm across GitHub and GitLab. OctoProbe also identified two attack servers not included in the earlier Genians or VULONE infrastructure lists.