DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea

This article covers multi-stage cyberattacks linked to North Korean threat actors (DPRK) targeting South Korean organizations, using GitHub as command-and-control (C2) infrastructure.

• •Obfuscated Windows LNK files delivered via phishing emails serve as the initial attack vector, dropping a decoy PDF and a malicious PowerShell script
• •The PowerShell script evades analysis by checking for VMs, debuggers, and forensic tools, then establishes persistence via a scheduled task running every 30 minutes
• •Compromised host data is exfiltrated to a GitHub repository using a hard-coded access token, with GitHub also used to fetch additional modules or instructions
• •The campaign leverages LolBins (Living off the Land Binaries) to minimize PE file drops, achieving a low detection rate
• •