DPRK Cyber Ops Leverage LNK Phishing and GitHub C2

Cyber Threat Intelligence has shed light on a concerning evolution in North Korean (DPRK) cyber attack methodologies. Recent observations indicate threat actors are increasingly employing LNK files for phishing campaigns and utilizing GitHub as a command-and-control (C2) infrastructure. This dual approach allows for initial compromise through deceptive shortcuts and maintains stealthy communication channels through a widely trusted platform.

The use of LNK files is particularly insidious. These shortcut files, when disguised as legitimate documents or executables, can be engineered to run malicious code upon activation. This tactic bypasses some traditional defenses that might flag executable files directly. Coupled with GitHub’s robust and often whitelisted nature, these attacks present a significant challenge. Threat actors can leverage public or private GitHub repositories to host payloads, exfiltrate data, or issue commands, making their C2 traffic blend seamlessly with legitimate developer activity.