Kimsuky Expands Its Cyber Espionage Arsenal With Local AI Development Environment
Brief
Kimsuky, the North Korean espionage group, has expanded a campaign known as Operation GitPower with a local artificial intelligence development setup.
It combines phishing emails with tools that may help create lures, review stolen material, and adapt operations faster. The entry point remains simple but effective.
Targets receive ZIP archives containing Windows shortcut, or LNK, files dressed up as correspondence, research material, embassy messages, financial records, legal documents, or event information. Opening one starts concealed PowerShell code while a document appears to keep the victim from noticing.
Analysts at Polyswarm identified the activity as a continuation of Kimsuky’s established espionage work, not a new way of breaking into networks.