Kimsuky expanded Operation GitPower against Ukrainian foreign-policy, security, and civil-society experts using reply-bait spearphishing that impersonated conference organizers and policy researchers. Follow-on payloads used PDF-disguised LNK files or a fake Zoom installer to launch VBE and PowerShell scripts, establish scheduled-task persistence, collect host data, and exfiltrate results through GitHub or a dedicated TCP C2. Genians linked the activity to Kimsuky through strong overlap in first.ini/help.ini code, GitHub Contents API handling, filename conventions, obfuscation markers, persistence design, and infrastructure. The campaign reused GitHub, GitLab, and Codeberg while adapting lures for Ukrainian, Japanese, and Korean targets.