Adversary Intelligence — 2026-05-19

North Korean Kimsuky Group Targets Defense Officials and Recruiters in Four Spear-Phishing Campaigns

BLUFBy routing C2 through GitHub, VSCode tunnels, and Microsoft's CDN, Kimsuky has effectively neutralized reputation-based defenses, forcing South Korean defense organizations toward behavioral detection or accepting sustained, targeted intelligence loss.

Logpresso's May 15 report identified four Kimsuky spear-phishing campaigns in Q1 2026, each with distinct lures targeting South Korean defense officials, foreign military attachés, cryptocurrency developers, corporate recruiters, and public sector employees 12. Three campaigns embedded payloads in oversized LNK files disguised as PDFs; the fourth delivered JSE scripts that decoded a reconnaissance DLL via certutil and rundll32, then established remote access by downloading a Microsoft-signed VSCode binary and tunneling through GitHub OAuth 12. Campaign 2 hosted payloads and received exfiltrated system data through a GitHub repository, and Campaign 3 generated MAC-address-keyed payloads from 103.67.196.25, restricting final-stage code delivery to pre-identified machines 12. Lure documents varied by campaign: Campaign 1 used resumes, business cards, and medical forms; Campaign 2 mimicked fake Solana security tool documentation; Campaign 3 used military competition materials; and Campaign 4 disguised payloads as graduate school training documents 2. Post-compromise C2 traffic was additionally routed through nelark[.]icu and yespp[.]co[.]kr alongside the GitHub and VSCode tunnel infrastructure 2.

Analysis
Per Logpresso alone with no independent corroboration, GitHub repositories, VSCode OAuth tunnels, and Microsoft CDN channels generate C2 traffic indistinguishable from routine developer activity, voiding the reputation-based perimeter controls most South Korean defense organizations deploy. Campaign 3's MAC-address-keyed payload delivery confirms pre-operational reconnaissance against named individuals, including foreign military attachés: deliberate intelligence collection, not opportunistic credential harvesting. Rapid infrastructure rotation across all four campaigns renders IOC-based blocking insufficient, requiring defenders to shift to behavioral detection centered on process relationships and scheduled task anomalies. Separate DPRK units sharing a common toolkit would equally explain the divergent C2 infrastructure and absent cross-campaign IOC overlap.

2 sources