#ParsedReport #CompletenessHigh
07-09-2026

Kimsuky Uses the AI Agent 'opencode' to Create Decoys as Its GitHub PAT-Based LNK Attacks Evolve

https://www.genians.co.kr/en/blog/threat_intelligence/ai-agent-opencode

Report completeness: High

Actors/Campaigns:
Kimsuky
Gitpower

Threats:
Spear-phishing_technique
Process_hacker_tool
Procmon_tool

Victims:
Financial institutions, Corporate personnel, Retail business operations

Industry:
Financial, Retail

Geo:
Korean

TTPs:
Tactics: 5
Technics: 8

IOCs:
File: 27
Url: 12
Command: 1
Path: 2
Domain: 1
Hash: 13
Email: 9

Soft:
Pastebin, Chrome, Google Chrome, BitLocker, NET Framework, Windows PowerShell, Microsoft Excel, Adobe Illustrator, Task Scheduler

Algorithms:
md5, zip, base64

Functions:
LinkInfo, Remove-Item, Get-Process, FromBase64String

Win Services:
VGAuthService

Languages:
powershell