The Hacker News and others report DPRK-linked attackers using phishing-delivered LNK files to run hidden PowerShell, persist, exfiltrate data to attacker GitHub repos, and fetch additional payloads, showing GitHub abuse as both infrastructure and camouflage.
DPRK-linked campaign uses malicious LNK files, encoded PowerShell, and GitHub for C2.
Persistence via Scheduled Tasks and strong evasion tactics observed
Fortinet Threat Research Blog | DPRK-Related Campaigns with LNK and GitHub C2
DPRK-linked attackers used GitHub as C2 in phishing-led attacks on South Korean orgs.
LNK files trigger hidden PowerShell, set persistence, and exfiltrate system data to attacker repos while pulling new payloads.
North Korean hackers abuse LNKs and GitHub repos in ongoing campaign
LNK files and GitHub C2 power new DPRK cyber Attacks
Phishing LNK files and GitHub C2 power new DPRK cyber Attacks
This finding is one of many signals tracked across Cyber Security. The live feed updates every few hours with new authority voices, debates, and emerging ideas.
← Back to Cyber Security