S2W's Threat Intelligence Center TALON documented in a report published by S2W TALON ongoing Kimsuky activity exploiting GitHub private repositories as both a malware delivery channel and an exfiltration destination — embedding hardcoded GitHub Private Access Tokens directly within PowerShell scripts to authenticate to attacker-controlled repositories, enabling dynamic script management, persistence, and victim system profiling without requiring traditional C2 infrastructure.
Initial Access: Tax Invoice Lure Delivering LNK
The campaign begins with a ZIP archive (NTS_Attach.zip) containing an LNK file disguised as an electronic tax invoice PDF (전자세금계산서.pdf.lnk). Executing the shortcut launches a PowerShell command that downloads and runs main.ps1 from an attacker-controlled GitHub repository (hxxps://github[.]com/God0808RAMA/group_0721/). The decoy document — impersonating a legitimate Korean National Tax Service invoice — is displayed to maintain victim deception while the infection chain proceeds silently.
GitHub-Based Payload Delivery and Dynamic Script Management
main.ps1 authenticates to the private GitHub repository using a hardcoded GitHub Private Token and downloads two files: a decoy document and real.txt. The script replaces the placeholder string $upFolder with a timestamped value formatted as ntxBill_{MMdd_HHmm}, re-uploads the modified script back to the repository as real.txt_{MMdd_HHmm}.txt, and downloads first.txt — saved locally as %AppData%\temporary.ps1 — for immediate execution. This timestamped upload/download cycle allows the attacker to dynamically manage and version scripts based on infection time, with each victim's repository folder serving as an individualized infection record.
Persistence via Scheduled Task Mimicking BitLocker
For persistence, main.ps1 writes a persistence launcher to %AppData%\MicrosoftEdgeUpdate.ps1 and creates a scheduled task with the deliberately benign-looking name:
BitLocker MDM policy Refresh{DBHDFE12-496SDF-Q48D-SDEF-1865BCAD7E00}
The task triggers once after a five-minute delay and repeats every 30 minutes thereafter, each time downloading the latest real.txt_{MMdd_HHmm}.txt from the GitHub repository, saving it as temporary.ps1, and executing it — enabling the attacker to push updated scripts to all active victims continuously via GitHub commit.
Info-Stealer: Comprehensive System Profiling Exfiltrated to GitHub
The initial temporary.ps1 (from first.txt) functions as an info-stealer collecting: IP address (first NIC), current timestamp, last boot time, OS metadata (caption, version, build, architecture), hardware details (manufacturer, model, domain, total memory via Win32_ComputerSystem), device type (notebook/desktop), OS installation date, and the full list of running processes. All data is written to a log file and uploaded to the attacker's GitHub repository under the victim-specific ntxBill_{MMdd_HHmm} folder — using GitHub's API as both an exfiltration endpoint and a persistent log store.
One test log recovered from the repositories contained the process names xeno_rat_server and rdpclip, confirming the presence of remote administration tools and clipboard monitoring on at least one test system — indicating Kimsuky may deploy XenoRAT as a follow-on payload against profiled victims.
Nine Identified Repositories and Attacker Email
By analyzing the hardcoded GitHub token, TALON identified nine private repositories associated with the attacker as of August 20, 2025: group_0717, group_0721, test, hometax, group_0803, group_0805, group_0811, fsc_doc, and repayment. Commit history from these repositories exposed the email address used during GitHub account creation: sahiwalsuzuki4[@]gmail.com. Repository contents included victim system logs, decoy documents, and files resembling payment reminders, business reports, and audit-related materials — all consistent with Kimsuky's targeting of South Korean financial and government sectors.