Fake PDF Files Hide Konni Malware Campaign Targeting Ukraine Organizations
SOCRadar links Operation Conflict Compass, a Konni espionage campaign using fake PDF shortcuts and the VelvetCake downloader, to Ukraine-focused targeting.
SOCRadar documents Operation Conflict Compass, attributed with moderate confidence to North Korea-linked Konni, targeting diplomacy, policy research, and NGO figures working on Ukraine. Weaponized ZIP archives contain Windows LNK files disguised as peace-proposal and resume PDFs that launch PowerShell, create a scheduled task running every minute, and deploy the VelvetCake downloader. VelvetCake fetches remote scripts, gathers system information, captures screenshots, uploads collected files to attacker infrastructure, and deletes local traces. Infrastructure tied to the operation appeared as early as August 2026, but no verified victim count was published.
- LNK shortcuts disguised as peace-proposal PDFs launch PowerShell and decoy documents
- VelvetCake downloader runs remote scripts, captures screenshots, exfiltrates files, cleans traces
- Attributed with moderate confidence to North Korea-linked Konni; themes target Ukraine-policy workers
- Infrastructure active since August 2026; no verified victim list published
- ATT&CK
- T1566.001 Spearphishing AttachmentT1059.001 PowerShellT1053.005 Scheduled TaskT1113 Screen CaptureT1041 Exfiltration Over C2 Channel
- Organizations
- SOCRadarVelvetCake
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dofamini.com.ua | lure URL prefix only; its ending is cut off. URL hxxps[://]dofamini[.]com[.]ua/media/CV_OlesiaTsvientukh_SocialResearcher_Sociologist_ |
| domain | jaemoolding25863.elementfx.com | 5t6r7e8w9q0[.]medianewsonline[.]com Campaign domain. Domain jaemoolding25863[.]elementfx[.]com Source-listed network indicator. Domain zvwb1ep7i[.]onl |
| domain | kovalenko.dothome.co.kr | name Data-upload address shown in the source. URL hxxps[://]kovalenko[.]dothome[.]co[.]kr/media/A_Century_Long_Peace_Architecture_for_Ru PDF-vi |
| domain | p1o2i3u4y5t6r7e8w9q0.medianewsonline.com | ing address shown in the execution-chain text. URL hxxp[://]p1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]com/login[.]php?OKey=$env:userdomain&Areyou=cake&Who=$env:u |
| domain | raw.githubusercontent.com | le prefix only; do not use as a complete URL. URL hxxps[://]raw[.]githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkef |
| domain | zvwb1ep7i.onlinewebshop.net | 3[.]elementfx[.]com Source-listed network indicator. Domain zvwb1ep7i[.]onlinewebshop[.]net Source-listed network indicator. IP address 111[.]92[.] |
| ipv4 | 111.92.246.145 | newebshop[.]net Source-listed network indicator. IP address 111[.]92[.]246[.]145 VelvetCake server; the source describes a connection |
| sha256 | 0db1e8a3075ffc2f5caa91abaeabb6ba4365ae0eda64d179374614a79e317733 | 7bb7cf790cd0b13b0439a Source-listed host indicator. SHA-256 0db1e8a3075ffc2f5caa91abaeabb6ba4365ae0eda64d179374614a79e317733 Source-listed host indicator. SHA-256 ec47a2101de4f1fc25995 |
| sha256 | 297292d46d4f11fc801f5d6d01251735698a8419aa3196db7b3aa7bb8ea85cad | pdateScheduler Task created for repeated execution. SHA-256 297292d46d4f11fc801f5d6d01251735698a8419aa3196db7b3aa7bb8ea85cad Source-listed host indicator. SHA-256 d398f11c236a59e44a9df |
| sha256 | 467660ef31b8ec248ae434fdee0a68de5098bcfd08776a4004ccbdcd7904bd37 | 9e6f6f84d6db7d3ba5937 Source-listed host indicator. SHA-256 467660ef31b8ec248ae434fdee0a68de5098bcfd08776a4004ccbdcd7904bd37 Source-listed host indicator. SHA-256 c88165d943f59014d6688 |
| sha256 | 76e9bdf193b3127623b674efdf3f0e3585932af33c9c85a3d6375d369de0e12a | 8ebc47601ebeca01311e1 Source-listed host indicator. SHA-256 76e9bdf193b3127623b674efdf3f0e3585932af33c9c85a3d6375d369de0e12a Source-listed host indicator. Note: IP addresses and domain |
| sha256 | 9f2cc22a74499b0a5b39a8f4732ff74d7338addd972387302016ba5a026936ac | a693409a65de89760eaaa Source-listed host indicator. SHA-256 9f2cc22a74499b0a5b39a8f4732ff74d7338addd972387302016ba5a026936ac Source-listed host indicator. SHA-256 d3e599af47b110ab526ee |
| sha256 | ac8df7baf7f1397a8c194840f6a5c1b0182088febde55f46d9f73ee8abc97c1d | 85e6ff8fdfe9109d05495 Source-listed host indicator. SHA-256 ac8df7baf7f1397a8c194840f6a5c1b0182088febde55f46d9f73ee8abc97c1d Source-listed host indicator. SHA-256 e162d64d3e69cea868f62 |
| sha256 | d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a | 196db7b3aa7bb8ea85cad Source-listed host indicator. SHA-256 d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a Source-listed host indicator. SHA-256 0db1e8a3075ffc2f5caa9 |
| sha256 | d3e599af47b110ab526ee38edaae68df3d8ab257e689e6f6f84d6db7d3ba5937 | 387302016ba5a026936ac Source-listed host indicator. SHA-256 d3e599af47b110ab526ee38edaae68df3d8ab257e689e6f6f84d6db7d3ba5937 Source-listed host indicator. SHA-256 467660ef31b8ec248ae43 |
| sha256 | e162d64d3e69cea868f62f63906098de310fad9fa1ca693409a65de89760eaaa | 55f46d9f73ee8abc97c1d Source-listed host indicator. SHA-256 e162d64d3e69cea868f62f63906098de310fad9fa1ca693409a65de89760eaaa Source-listed host indicator. SHA-256 9f2cc22a74499b0a5b39a |
| sha256 | e41fdf41e6f5d089d1b8d7ea6f6a5c76760fe2a553c8ebc47601ebeca01311e1 | DF, so this is not a usable complete SHA-256 value. SHA-256 e41fdf41e6f5d089d1b8d7ea6f6a5c76760fe2a553c8ebc47601ebeca01311e1 Source-listed host indicator. SHA-256 76e9bdf193b3127623b67 |
| sha256 | ec47a2101de4f1fc25995e775ddb48e20977081c4d885e6ff8fdfe9109d05495 | 4d179374614a79e317733 Source-listed host indicator. SHA-256 ec47a2101de4f1fc25995e775ddb48e20977081c4d885e6ff8fdfe9109d05495 Source-listed host indicator. SHA-256 ac8df7baf7f1397a8c194 |
From the original article
4 min read at cybersecuritynews.com
A newly documented campaign targeting people and organizations focused on Ukraine uses document-themed Windows shortcuts to install a malware downloader called VelvetCake. The goal appears to be gathering political and military intelligence about the war. The attackers likely send targeted emails with ZIP attachments.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.