How North Korean hackers turn legitimate infrastructure into an attack surface

Newly published research from Fortinet’s FortiGuard Labs has confirmed how threat actors linked to North Korea are using legitimate public infrastructure, in the form of the GitHub API alongside Microsoft LNK files, as command and control for campaigns targeting Windows users.

The XenoRAT malware campaigns employ a multi-stage scripting process that includes PowerShell execution, includes mechanisms to enable threat persistence, and ultimately leads to data exfiltration from the target environment.

The DPRK hackers have evolved tactically during the last two months, said Cara Lin, a Cybersecurity Threat Research Manager at FortiGuard Labs, and “now embed decoding functions within LNK arguments and include encoded payloads directly inside the files.”

Decoy PDF documents are dropped that have a direct alignment with the theme of the LNK file itself, which helps fool victims into believing that the file has opened normally. What’s actually happening is that a malicious PowerShell script is executing in perfect silence in the background.

“This campaign demonstrates a sophisticated grasp of social engineering,” Lin continued, “employing multiple phishing themes to boost the attack’s effectiveness.”

There is, it would appear, no necessity for complex custom malware after all, just native Windows tools, to deal with everything from initial deployment to detection evasion and persistence.

“By minimising the use of dropped PE files and leveraging LolBins, the attacker can target a broad audience with a low detection rate,” Lin warned.

A portable execution (PE) file is a standard format for system files and executable in Windows, while Living-off-the-Land Binaries (LolBins) are pre-installed and legitimate system tools. The use of these two combined makes it easier to execute a malicious threat while keeping it disguised as normal network activity.

Main takeaway from North Korean hackers report

But the main takeaway here is the use, or should I say abuse, of that legitimate public infrastructure.

“The attacker uses the GitHub API as a Command and Control channel, effectively hiding malicious traffic within normal encrypted connections,” Lin explained. This is important as GitHub is often listed as a trusted platform in the corporate security environment.

Throw in the addition of the Windows legit capability exploitation and the legitimate tooling and trusted services combo creates what Lin refers to as “a highly effective infection chain”.

“By relying on native utilities like PowerShell and scheduled tasks instead of dropping recognizable custom malware,” said Jason Soroko, a Senior Fellow at Sectigo, “these attackers turn a network’s own administrative functions against the organization.”

Traditional perimeter defences are, therefore, somewhat stymied by this. Soroko added: “Security teams must move beyond simple blocklists and prioritise behavioral monitoring, scrutinise network anomalies and closely watch the execution of built-in utilities to uncover the hidden threats operating quietly within their environments.”

I’ll leave the last word to Jamie Boote, a Senior Manager of Strategic Security Consulting at Black Duck, who told me that malicious actors are, in effect, turning legitimate infrastructure into a novel attack surface.

“This reflects a larger shift towards turning the cloud-hosted and AI-assisted developer toolchain into an attack surface,” said Boote “and operations should start turning their attention to providing secure use of these internet-connected and always-on network services.”

More from security expert Davey Winder

• The US router ban hammer has been wielded – here’s why it’s so stupid
• The great mobile banking heist starts on your smartphone
• The cybercrime economy is embracing agentic AI — and that’s a problem