Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.
SOCRadar reports that North Korea-linked Konni is running Operation Conflict Compass, a cyberespionage campaign against Ukraine-focused diplomatic, policy, NGO, and defense audiences. Spear-phishing ZIP archives contain LNK shortcuts disguised as PDFs; opening one runs PowerShell that downloads a VBScript persistence component and the VelvetCake downloader from GitHub. A scheduled task named OneDriveUpdateScheduler relaunches the lightweight task runner every minute, which fetches PowerShell modules over raw TCP port 12345, collects host and network data plus screenshots, exfiltrates results, and deletes artifacts. A trojanized Zoom installer variant was also used, and SOCRadar assesses a moderate-confidence link to Konni, also known as TA406 and Opal Sleet within the Kimsuky umbrella.
- Operation Conflict Compass delivers ZIP archives containing LNK files disguised as PDFs.
- Lures cover Ukraine diplomacy, a researcher résumé, and food-price disruption.
- GitHub-hosted payloads persist through a task named OneDriveUpdateScheduler.
- VelvetCake pulls PowerShell tasks over TCP port 12345, then deletes local artifacts.
- SOCRadar attributes the campaign to Konni, also tracked as TA406 and Opal Sleet.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1059.001 PowerShellT1053.005 Scheduled TaskT1113 Screen Capture
- Threat actors
- KonniTA406Opal SleetKimsuky
- Malware
- VelvetCake
- Organizations
- SOCRadar
- Countries
- North KoreaUkraine
From the original article
4 min read at gbhackers.com
North Korea-linked threat actor Konni has launched a targeted cyberespionage operation against Ukraine-focused entities using malicious Windows shortcut files disguised as PDF documents. The campaign, tracked by SOCRadar Threat Research Unit as Operation Conflict Compass, deploys a modular PowerShell malware family dubbed VelvetCake to collect intelligence on the Russia-Ukraine war.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.