Cyber actors, suspected to be linked to North Korea (DPRK), have been seen leveraging GitHub as a command center in complex, staged attacks against South Korean organizations.

As detailed by Fortinet FortiGuard Labs, the attack process starts with disguised Windows shortcut (LNK) files. These files drop a fake PDF and a PowerShell script, setting up the next attack stage. These LNK files are likely spread through phishing emails.

When the malicious content is downloaded, the victim sees the PDF, while the PowerShell script quietly runs in the background. This script is designed to avoid detection by checking for virtual machines, debuggers, and forensic tools. If any of these are found, the script stops immediately.

If no analysis tools are detected, the script extracts a Visual Basic Script (VBScript) and creates a scheduled task for persistence. This task runs the PowerShell payload every 30 minutes in a hidden window to avoid being noticed, ensuring the PowerShell script runs automatically after each system restart.

The PowerShell script then gathers information about the infected machine, saves it to a log file, and sends it to a GitHub repository under the account “motoralis” using a built-in access code. Other GitHub accounts used in the campaign include “God0808RAMA,” “Pigresy80,” “entire73,” “pandora0009,” and “brandonleeodd93-blip.”

The script then accesses a specific file in the same GitHub repository to retrieve additional modules or instructions. This allows the attacker to exploit the trust associated with GitHub to hide their activity and maintain ongoing control over the infected computer.

Fortinet noted that earlier versions of the campaign used LNK files to distribute malware like Xeno RAT. The use of GitHub for C2 in distributing Xeno RAT and its MoonPeak version was previously reported by ENKI and Trellix last year. These attacks were linked to Kimsuky, a North Korean government-backed group.

“Instead of relying on complex, custom-built malware, the attacker uses standard Windows tools for deployment, evasion, and persistence,” said security researcher Cara Lin. “By reducing the reliance on dropped PE files and using LolBins, the attacker can target a wide range of victims with a low chance of being detected.”

This disclosure follows a report by AhnLab detailing a similar LNK-based infection process from Kimsuky, which results in the deployment of a Python-based backdoor.

As before, the LNK files execute a PowerShell script and create a hidden folder in the “C:\windirr” path to store malicious components, including a fake PDF and another LNK file disguised as a Hangul Word Processor (HWP) document. Also deployed are intermediate components to establish persistence and launch a PowerShell script, which then uses Dropbox as a C2 channel to retrieve a batch script.

The batch file then downloads two parts of a ZIP file from a remote server (“quickcon[.]store”), combines them to create a complete archive, and extracts an XML task scheduler and a Python backdoor. The task scheduler then launches the malware.

The Python-based malware can download additional components and execute commands from the C2 server. These commands allow it to run shell scripts, list directories, upload/download/delete files, and run BAT, VBScript, and EXE files.

These findings also align with ScarCruft‘s move away from traditional LNK-based attacks to an HWP OLE-based method to deliver RokRAT, a remote access trojan used exclusively by the North Korean hacking group, according to S2W. Specifically, the malware is embedded as an OLE object in an HWP document and executed through DLL side-loading.

“Unlike previous attack sequences that went from LNK-dropped BAT scripts to shellcode, this case confirms the use of newly developed dropper and downloader malware to deliver shellcode and the ROKRAT payload,” the South Korean security company said.