North Korean Hackers Use Spear-Phishing to Seek Ukraine War Intelligence
Summary
Researchers say North Korean-linked actors are spear-phishing Ukrainian government, policy and academic targets for intelligence on the war, military casualties and prisoners. Attacks use reply-baiting and malicious LNK files disguised as PDFs.
Key points
- Genians researchers linked separate findings to a Kimsuky campaign seeking information about the war, North Korean casualties and the two North Korean prisoners transferred to South Korea.
- A phishing lure impersonated organizers of KSCON 2026 and offered travel costs and a speaker fee; replies led to a malicious LNK file disguised as a PDF.
- Reported techniques include basic command obfuscation, scheduled tasks for persistence, and using public repositories such as GitHub and GitLab to host scripts, documents and commands.
- Proofpoint tracks related activity as TA406 and says the group appeared less active in 2026 than in 2025; analysts also see potentially distinct activity clusters, complicating attribution.
- Researchers and analysts described the attacks as relatively rudimentary, while warning that their pace and volume can burden defenders.
Article Details
- Event Type
- Espionage campaign involving spear-phishing against Ukrainian government, policy, academic, and security-related targets. Genians attributes the campaign to Kimsuky; other activity described in the article has differing or uncertain attribution.
- Impact
- The campaign seeks intelligence about the war situation, North Korean military casualties, prisoner investigations and handling, and the two North Korean prisoners transferred from Ukraine to South Korea. The article reports targeting and attempted intelligence gathering, but does not specify confirmed data theft or other direct impact.
MITRE ATT&CK
People
Threat Actors
HoneycrispTemporary designation used by Proofpoint for a subcluster associated with targeting education and former diplomats; its relationship to TA406 is not established.KimsukyGenians attributes the campaign targeting Ukrainian war intelligence to Kimsuky; the article also describes separate South Korean targeting associated with the group.KonniThe article identifies Konni as a group with which TA406 overlaps and as a better-known name associated with that activity.Opal SleetThe article identifies Opal Sleet as a group with which TA406 overlaps and as a better-known name associated with that activity.TA406Proofpoint-tracked actor associated with North Korean government-linked spear-phishing against Ukrainian government agencies; Proofpoint says its activity appears less active in 2026 than in 2025.
Products
GitHubtasks for persistence, and scripts, documents, and commands hosted via public repository services like GitHub and GitLab. Like other lazy hackers, the group has been experimenting with large language models (LLMs),GitLabpersistence, and scripts, documents, and commands hosted via public repository services like GitHub and GitLab. Like other lazy hackers, the group has been experimenting with large language models (LLMs), theGoogle MeetIts recent attacks have also been peppered with pretty obvious errors, like emails inviting victims to Google Meet calls that actually contain Zoom links.Zoomwith pretty obvious errors, like emails inviting victims to Google Meet calls that actually contain Zoom links.
Countries
North Koreafrom local firm Enki White Hat described tactics, techniques, and procedures (TTPs) he associated with North Korea's advanced persistent threat (APT) "Kimsuky." The presentation focused on continuing attacks againstSouth Koreadidn't all go to plan, though. For example, Ukraine transferred two North Korean prisoners of war to South Korea.UkraineNorth Korean state-sponsord hackers are spear-phishing government, policy, and academic circles in Ukraine to pilfer intelligence about the country's own position in the Russia-Ukraine war.
Industries
AcademicNorth Korean state-sponsord hackers are spear-phishing government, policy, and academic circles in Ukraine to pilfer intelligence about the country's own position in the Russia-Ukraine war.EducationWith Honeycrisp, "We're actually seeing a good amount of targeting of education, and, particularly, either spoofing or targeting former diplomats who have landed in places like higher education or think tanks. So we'reGovernmentNorth Korean state-sponsord hackers are spear-phishing government, policy, and academic circles in Ukraine to pilfer intelligence about the country's own position in the Russia-Ukraine war.