Skip to content
Kimsuky Expands Malware Campaign Using Fake Zoom Installers

Kimsuky Expands Malware Campaign Using Fake Zoom Installers

First seen 14 Oct 2026, 14:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 16:34 UTC
  • •Kimsuky uses fake Zoom installers and malicious LNK files for malware deployment.
  • •The campaign targets Ukrainian experts in diplomacy and security sectors.
  • •Attack methods include spear phishing and hidden PowerShell execution.

The North Korea-linked cyber espionage group Kimsuky has intensified its Operation GitPower by deploying malware through fake Zoom installers and malicious Windows shortcut files (LNK). Targeting Ukrainian experts in diplomacy and security, the campaign employs spear phishing tactics and hidden PowerShell execution to compromise systems. Researchers from Genians Security Center reported that the attackers utilize public code-hosting platforms to deliver malicious payloads. The attack vector includes PDF-themed LNK files that lure victims into executing harmful scripts. This operation is part of a broader strategy to exploit trust and gain access to sensitive information. The current status of the campaign indicates ongoing threats to the targeted sectors.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-14
Kimsuky expands Operation GitPower
The North Korea-linked group Kimsuky has begun using fake Zoom installers and malicious LNK files to target Ukrainian experts.
IT Security News

More articles in this cluster (4)

Following this threat?

Track Funhouse and Kimsuky in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 3

Common questions

Who is targeted by this campaign?
The campaign primarily targets Ukrainian experts in diplomacy, security, and international policy.
What methods are used in the attack?
The attackers use fake Zoom installers, malicious LNK files, and spear phishing tactics to deploy malware.
Is there evidence of active exploitation?
Yes, researchers have confirmed that Kimsuky is actively exploiting these methods to compromise systems.