A conference invitation sent to a Ukrainian policy expert asked for a reply before it delivered anything dangerous. The later “PDF” was a Windows shortcut, and opening it could start scripts while displaying an innocent document. A new Genians investigation links these August 2026 attempts to Operation GitPower, activity the researchers attribute to North Korea-linked Kimsuky. Genians says most observed attempts against the Ukrainian targets were unsuccessful; this is a new reconstruction of earlier attacks, not evidence of a new nationwide breach.
The first email asked for permission to send the trap
One approach impersonated the Korea Cyber Security Conference, using the real event’s details and a recipient’s professional background. Travel, accommodation and an honorarium made the invitation worth answering. The sender, however, used a Proton Mail address rather than the organizer’s domain. No attachment or malicious URL was needed in that first message.
That changes the trust test. A plausible conference and a clean opening email do not authenticate the person offering the invitation. Before accepting follow-up files, contact the organization through details obtained independently. The question is who is speaking, not whether the event exists.
Example
From: KCSCON, kcscon [at] proton [dot] me
Subject: Invitation to speak at KCSCON 2026
Dear colleague,
We would like to invite you to speak at our security conference in Seoul. Travel, accommodation and a speaker honorarium are offered. Please reply to confirm your availability and whether you would like the official PDF invitation.
The example illustrates the request; it is not the recipient’s original email. The important feature is what is absent: the first contact does not need a download, a button or an attachment.
A PDF icon covered up a shortcut
The follow-up conference archives paired an HTML invitation with a file whose full name ended in .pdf.lnk. A PDF icon and a hidden shortcut extension made the latter look like a document. In one variant, KCSCON_2026_Official_Invitation.pdf.lnk was the executable entry point. A later archive also added a password, making attachment inspection harder.
Genians’ published file view shows the small shortcut-arrow overlay on the apparent PDF. Treat that as a reason to stop, rather than opening the file to check. A document-looking name is not a file-type guarantee. A shortcut can launch another program; the legitimate HTML beside it does not make that action safe.
The document opened while scripts did the work
Digital Security Lab Ukraine had documented the related analytical-collaboration lure in August. A message offering research cooperation contained no links. Only after a reply did the sender supply a Codeberg archive. Opening its disguised shortcut displayed a genuine PDF while fetching scripts from GitLab in the background. GitHub then served as a place for commands and collected information.
DSLU found a task imitating a Google updater that ran every 15 minutes, system profiling, and a listing of the Downloads folder. The initial collection was not proof that every document’s contents had been stolen: a directory listing reveals filenames, while later operator commands can change what happens next. Repository logs and changing scripts also meant a single file hash could not describe the entire evolving operation.
The new Genians analysis adds a revealing implementation mistake: an early persistence script saved one filename but told its scheduled task to run another. A revision aligned the names and corrected related deletion logic. The attempted espionage was neither automatically successful nor technically flawless. Its strength was getting a target to authorize what looked like ordinary professional correspondence.
Keep a reply separate from running a file
Replying to a message is not the same as executing the shortcut. If you only answered, stop the exchange and verify the claimed sender independently. If you downloaded the archive without opening its contents, do not run the apparent PDF. Preserve the message and report it to your organization’s security contact.
If you opened the shortcut, disconnect the affected computer from the network and involve the security team before deleting evidence. Removing one visible file may leave a scheduled task or another script behind. On a personal Windows PC, once evidence needs are addressed, use Gridinsoft Anti-Malware: install it, update the database, run a Full Scan, review and remove detected threats, then restart. A scan can find malicious components; it cannot undo information already sent out or prove no access occurred.
If the page or email made you download an invoice, coupon, tracking app, browser extension, or support tool, scan the PC before opening it again or logging into sensitive accounts.
Scan for malicious scriptsFor a separate Ukrainian-targeted campaign that hid a backdoor behind a useful-looking application, see the MATCHBOIL fake planner investigation. The overlap is the trust decision around execution, not proof that the two campaigns share an operator.
GitPower’s lesson is specific: a legitimate event, familiar hosting service and visible PDF can all accompany an attacker-controlled shortcut. Verify the invitation before the conversation becomes permission to run code.
References
- Genians Security Center. Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War. Displayed October 12, 2026; accessed October 12, 2026.
- Digital Security Lab Ukraine. Living off GitHub: From Gmail Reply-Baiting to Fileless Exfiltration. August 24, 2026; updated August 25, 2026.
