North Korea Phishes Ukrainians for War Intel
North Korean hackers are spear-phishing Ukrainian officials and researchers to collect intelligence on the Russia-Ukraine war.
South Korea-based Genians reports that North Korean state-sponsored hackers are using reply-baiting spear-phishing against Ukrainian government, policy, and academic targets to gather intelligence about Pyongyang's involvement in the Russia-Ukraine war. Earlier Proofpoint research tracked related attacks since at least February 2025 as TA406, overlapping Konni and Opal Sleet. Digital Security Lab Ukraine later investigated a spear-phishing incident against a Ukrainian civil servant, and Enki White Hat separately described Kimsuky tactics.
- DPRK operators are phishing Ukrainian government, policy, and academic targets.
- The reported goal is intelligence on North Korea's role in the Ukraine war.
- Proofpoint links earlier activity to TA406, overlapping Konni and Opal Sleet.
- Later reporting also discusses Kimsuky tactics against related targets.
- ATT&CK
- T1566 Phishing
- Threat actors
- TA406KonniOpal SleetKimsuky
- Countries
- North KoreaUkraineRussiaSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | ca01091a9a7153d382dc2017f8e8aec9 | office-bug-within-days#recipe=similar-items&sourcecontentid=ca01091a9a7153d382dc2017f8e8aec9) Russian Hackers Weaponize Microsoft Office Bug in Just 3 |
From the original article
9 min read at darkreading.com
The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.
By Nate Nelson · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.