source_4019.pdf (2 MB)

Kimsuky, a DPRK state-sponsored espionage group, has expanded its social-engineering arsenal with AI-assisted lure development and QR-code phishing that directs victims to credential-harvesting portals or malicious Android packages. Its August 2026 Operation GitPower used disguised LNK files, hidden PowerShell, sandbox checks, command-history deletion, and deceptively named scheduled tasks. The group collects credentials, session tokens, keystrokes, screenshots, documents, and GPKI certificates while using GitHub, Pastebin, Dropbox, Slack, dynamic DNS, tunneling services, and compromised websites for delivery, command and control, or exfiltration. Hive Pro also links the group to historical exploitation of multiple Microsoft and ScreenConnect vulnerabilities and to the earlier Operation Kabar Cobra campaign.