Kimsuky GitPower Marker Header 'aohvcoehfg' to GitHub Raw Content

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

Detects anomalous HTTP traffic directed to githubusercontent.com containing a custom, non-standard request header 'aohvcoehfg'. This pattern is associated with Kimsuky threat actor activity, specifically related to the 'GitPower' operation involving C2 communication via GitHub repositories.