Kimsuky, a notorious cyber threat actor, has recently been observed leveraging AI-generated documents alongside traditional phishing strategies to distribute AsyncRAT, a remote-access trojan. This campaign highlights how traditional methods can be revitalized with the integration of sophisticated, AI-enhanced content.
Innovative Phishing Tactics
The operation, identified as Operation GitPower, initiates with ZIP files containing Windows shortcuts that masquerade as typical documents. When opened, these shortcuts execute hidden PowerShell scripts while simultaneously displaying a benign PDF, minimizing the victim’s suspicion of malicious activity.
Genians, a cybersecurity firm, uncovered this campaign by tracking infrastructure related to GitHub and GitLab activities. According to a report shared with Cyber Security News, the targets span diplomatic, military, security, virtual-asset, policy, and academic sectors.
AI-Driven Attack Mechanisms
The attack’s sophistication lies not just in a single malware delivery but in its ability to update scripts via public code repositories, utilize trusted web traffic, gather system information, and maintain persistence through scheduled tasks. This emphasizes the importance of early behavioral detection, as evidenced by a similar North Korean GitHub C2 campaign.
Operators employed local language models using platforms like Ollama, GPT4All, and Msty. Although no evidence suggests that the attackers trained their models, the presence of a GPT4All LocalDocs database indicates a capability to search and utilize documents as an AI knowledge base.
Challenges in Detection and Defense
During the attack, AI-generated decoys, covering themes like investment and game development, were used to enhance the credibility of phishing attempts. These documents’ polished appearance makes it harder for targets to rely solely on content quality as a phishing indicator.
Scripts downloaded via GitHub fetched additional files, collecting extensive operating system and network data. This information could guide attackers on how to proceed with their intrusion, exploiting the normal appearance of GitHub traffic to evade detection.
Recommendations for Security Teams
The campaign’s use of disguised image files containing encrypted .NET AsyncRAT payloads, such as those named apple.png and fox.png, reflects common evasion techniques. Organizations should prioritize monitoring ZIP files with LNK shortcuts executing cmd.exe or PowerShell, particularly those with unusually long arguments.
Security teams should correlate these events with hidden PowerShell scripts, new scripts in temporary directories, scheduled task creation, and GitHub traffic. By focusing on the sequence of events rather than individual actions, defenders can better counteract the latest AsyncRAT delivery methods.
While AI advancements in phishing create more convincing and harder-to-detect lures, the underlying actions required to execute malware remain unchanged. By linking these actions, security teams can identify and mitigate such campaigns effectively.
