Kimsuky "Operation GitPower": Korean insurance and contract lures, PDF-disguised shortcuts delivered from GitHub

Content anchor: a YARA rule on the shortcut file itself. It matches the hex-in-hex PowerShell wrapper and the hex-encoded persistence the shortcut carries. It does not key on hosts, task names, variable names or command-server parameters, which change between waves. The rule requires the shortcut header at the very start of the file, so a web page or report that quotes the command cannot match. The search half tracks three URL shapes the operator has kept since September 2026: the delivery path raw[.]githubusercontent[.]com/<account>/<random repository>/main/attachments_<name>.zip; the command-server request /setting.php?aaaaaa=… (/setting.php?banana=… in some waves); and decoy file names ending in 565978892140.pdf. Neither the command servers nor the decoy hosts are listed by name. The command servers sit on random subdomains of free web-hosting domains (onlinewebshop[.]net, mygamesonline[.]org, myartsonline[.]com and others), on one address shared with many unrelated sites. The decoys sit on free-hosting subdomains (lovestoblog[.]com, great-site[.]net, wuaze[.]com and others), and each wave brings new ones. The decoy PDFs are genuine public forms re-hosted by the operator, so their hashes are not tracked either. The GitHub accounts are new for each wave, and since October 2026 they have been registered with e-mail addresses on operator-owned domains such as insureall[.]online and hotelbook[.]world.