NORTH Korean state-sponsored actors have been conducting spear-phishing campaigns aimed at Ukrainian government, policy, and academic circles to prise out war-related intelligence. Researchers describe the operation as a relatively crude but ongoing effort to surface information about Ukraine’s war position, battlefield casualties, prisoner handling, and related context.
The activity has been tracked across multiple groups and reports, with Genians Security Center aggregating findings into a single Kimsuky-led campaign focused on Ukraine to gather war intelligence.
The attacks typically rely on reply-baiting rather than overt malware attachments. In one observed case, targets in Ukrainian foreign affairs and security sectors received a message impersonating the organising committee of KSCON 2026, including authentic event details and incentives to engage. Replies would trigger an invitation containing a malicious shortcut file (LNK) masquerading as a PDF via a PDF icon and double extension (".pdf[.]lnk").
Beyond this, the group has used basic command obfuscation, scheduled tasks for persistence, and scripts and documents hosted on public repositories such as GitHub and GitLab. Analysts note occasional use of large language models and occasional errors in social engineering, such as Zoom links embedded in invitations.
Evidence from Proofpoint, DSLU and Genians points to a widening, albeit uneven, campaign landscape attributed to North Korean actors such as TA406 and the Kimsuky cluster. While attribution remains complex, researchers emphasise that the threat is not highly sophisticated but nonetheless capable of collecting strategic information; organisations are advised to maintain vigilance for reply-driven phishing and to scrutinise event-themed outreach that requests sensitive or guest-lecture responses.