#ParsedReport #CompletenessHigh
06-09-2026

Kimsuky Creates a Lure with AI Agent 'opencode': Evolution of GitHub PAT-Based LNK Attacks

https://www.genians.co.kr/blog/threat_intelligence/ai-agent-opencode

Report completeness: High

Actors/Campaigns:
Kimsuky
Gitpower

Threats:
Spear-phishing_technique
Process_hacker_tool
Procmon_tool

Victims:
Financial sector, Corporate personnel, Diplomatic sector, Security sector, Academic sector, Distribution operations

Industry:
Financial

Geo:
Korea

TTPs:
Tactics: 6
Technics: 8

IOCs:
File: 27
Url: 12
Command: 1
Path: 3
Domain: 1
Hash: 13
Email: 10

Soft:
Pastebin, Chrome, Google Chrome, BitLocker, NET Framework, Windows PowerShell, Microsoft Excel, Adobe Illustrator, hrome co, Task Scheduler, have more...

Algorithms:
zip, exhibit, md5, base64

Functions:
LinkInfo, Remove-Item, Get-Process, FromBase64String

Win Services:
VGAuthService

Languages:
powershell