TA406 (Threat actor): news timeline & CVEs

Fake PDF Files Hide Konni Malware Campaign Targeting Ukraine Organizations

SOCRadar links Operation Conflict Compass, a Konni espionage campaign using fake PDF shortcuts and the VelvetCake downloader, to Ukraine-focused targeting.

SOCRadar documents Operation Conflict Compass, attributed with moderate confidence to North Korea-linked Konni, targeting diplomacy, policy research, and NGO figures working on Ukraine. Weaponized ZIP archives contain Windows LNK files disguised as peace-proposal and resume PDFs that launch PowerShell, create a scheduled task running every minute, and deploy the VelvetCake downloader. VelvetCake fetches remote scripts, gathers system information, captures screenshots, uploads collected files to attacker infrastructure, and deletes local traces. Infrastructure tied to the operation appeared as early as August 2026, but no verified victim count was published.

Cyber Security NewsSep 24, 13:39 UTC · 2d agoThreat actor in the wild 3 sources

Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks

RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries.

RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries, using fake TV app delivery and custom crypto.

GBHackersupdated Sep 25, 09:30 UTC · 1d agofirst Sep 24, 09:41 UTC · 2d agoOther 6 sources

Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files

North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.

SOCRadar reports that North Korea-linked Konni is running Operation Conflict Compass, a cyberespionage campaign against Ukraine-focused diplomatic, policy, NGO, and defense audiences. Spear-phishing ZIP archives contain LNK shortcuts disguised as PDFs; opening one runs PowerShell that downloads a VBScript persistence component and the VelvetCake downloader from GitHub. A scheduled task named OneDriveUpdateScheduler relaunches the lightweight task runner every minute, which fetches PowerShell modules over raw TCP port 12345, collects host and network data plus screenshots, exfiltrates results, and deletes artifacts. A trojanized Zoom installer variant was also used, and SOCRadar assesses a moderate-confidence link to Konni, also known as TA406 and Opal Sleet within the Kimsuky umbrella.

GBHackersupdated Sep 24, 13:39 UTC · 2d agofirst Sep 24, 09:34 UTC · 2d agoThreat actor in the wild 3 sources

TA406

Timeline3 articles

Appears with

Fake PDF Files Hide Konni Malware Campaign Targeting Ukraine Organizations

Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks

Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files