Malware And CampaignsCampaign

DPRK linked campaigns using LNK files and private GitHub repositories as C2

April 4, 2026Cyber_OSINT

Cyber_OSINT cites FortiGuard reporting that DPRK-linked actors use LNK files and GitHub-based command and control from private repositories to evade detection, exfiltrate system data, and persist via scheduled tasks.

FortiGuard notes DPRK-linked campaigns using LNK files and GitHub C2 to evade detection, exfiltrating system data and maintaining persistence via scheduled tasks and C2 from private GitHub repositories.
Cyber_OSINT
githubmalicious softwarethreat actorgithubthreat actor

See what experts are saying right now

This finding is one of many signals tracked across Cyber Security. The live feed updates every few hours with new expert voices, debates, and emerging ideas.

← Back to Cyber Security