Kimsuky Uses Fake Zoom Installers and Malicious LNK Files to Deploy Malware

What happened

North Korea-linked cyber espionage group Kimsuky has expanded its Operation GitPower campaign by using fake Zoom installers and malicious Windows shortcut files to target Ukrainian experts working in diplomacy, security, and international policy. Researchers at Genians Security Center found that the campaign combines reply-baiting spear phishing, PDF-themed LNK files, public code-hosting platforms, hidden PowerShell execution, […] The post Kimsuky Uses Fake Zoom Installers and Malicious LNK Files to Deploy Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

Researchers at Genians Security Center found that the campaign combines reply-baiting spear phishing, PDF-themed LNK files, public code-hosting platforms, hidden PowerShell execution, scheduled-task persistence, and command-and-control infrastructure. cyber security Cyber Security News Malware 3 min.

The attacks begin with highly tailored emails impersonating conference organizers, policy researchers, or other trusted professional contacts. In one case, the operators posed as the organizers of the Korea Cyber Security Conference and invited Ukrainian security experts to participate as speakers.

The messages included legitimate event details but initially contained no malicious attachment or link, a tactic intended to encourage a reply while evading gateway-based phishing detection. After the recipient responded, Kimsuky sent a ZIP archive masquerading as official invitation material. The archive included an HTML decoy alongside a malicious LNK file with a filename such as KCSCON_2026_Official_Invitation.pdf.lnk .

Key facts

• Researchers at Genians Security Center — found: that the campaign combines reply-baiting spear phishing, PDF-themed LNK files, public code-hosting platforms, hidden PowerShell execution, […] The post Kimsuky Uses Fake Zoom Installers and Malicious LNK Files to Deploy Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform
• Researchers at Genians Security Center — found: that the campaign combines reply-baiting spear phishing, PDF-themed LNK files, public code-hosting platforms, hidden PowerShell execution, scheduled-task persistence, and command-and-control infrastructure