`https://gitlab.com/rabbit779`

https://gitlab.com/rabbit779 is a GitLab account that 2 published sources report in connection with Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from wezard4u and Joe Security. The earliest of those reports is dated 2026-10-30 and the most recent 2026-11-08.

gitlab account KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

Listed as rabbit779

First seen 2026-10-30 · last seen 2026-11-08

Sources

…전달된 명령을 실행하고 종료를 하는 방식을 사용하고 있습니다. mode 15,1 콘솔 창의 크기를 15열, 1행으로 설정하려는 명령을 사용해서 사용자에게 악성코드가 실행하는 콘솔이 보이지 않게 처리합니다. 2.GitLab에서 PDF 문서 다운로드 https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads" -o "%appdata%\whiskak.pdf" 옵션 의미 -k:HTTPS 인증서 검증 생략 -L:HTTP 리다이렉션 추적 -o:다운로드 결과를 지정된 파일에…
북한 Kimsuky(김수키) 미·중 정상회담 관련 일본어 문서로 위장한 악성 코드 분석-米中首脳会談とトランプ次期政権の対北朝鮮政策に関する資料質問紙.pdf — wezard4u · under “악성코드 분석” · published 2026-11-08 · pulled 2026-11-12
…Type Value Source context Payload repository gitlab.com/rabbit779/giraff88 LNK and downloaded loader Decoy URL https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads LNK arguments Loader URL…
Malware and Phishing Analysis Report - f8adbea62ff58587267d39b04fbcd784df1886e9d8c1b212348a9d95d133f6c2 — Joe Security · under “Indicators of Compromise” · published 2026-10-30 · pulled 2026-11-12

Find this indicator in the index, or see every GitLab account this site holds under GitLab accounts in the browse listing.

Related indicators

Cited by the same report: Malware and Phishing Analysis Report - f8adbea62ff58587267d39b04fbcd784df1886e9d8c1b212348a9d95d133f6c2

Joe Security lists 8 other indicators in this source.