THREATOPS
THREAT OPSThreat News › DPRK-Related Campaigns with LNK and GitHub C2

DPRK-Related Campaigns with LNK and GitHub C2

lowfortinet_researchPublished 2026-04-02

<p>Analysis of DPRK-linked LNK-based attacks using GitHub as covert C2 infrastructure, detailing multi-stage PowerShell execution, persistence mechanisms, and data exfiltration techniques targeting Windows environments.</p><img align="left" alt="" border="0" height="1" hspace="0" src="https://feeds.fortinet.com/~/i/953053052/0/fortinet/blog/threat-research" style="border: 0; float: left; margin: 0

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://feeds.fortinet.com/~/953053052/0/fortinet/blog/threat-research~DPRKRelated-Campaigns-with-LNK-and-GitHub-C