North Korean state-sponsored hackers are conducting spear-phishing campaigns targeting Ukrainian government, policy, and academic circles to gather intelligence on the country's position in the Russia-Ukraine war, with further coverage provided by Dark Reading.
The Democratic People's Republic of Korea (DPRK) has been actively engaged in espionage against Ukraine for several years, according to Genians Security Center. Threat actors, including those associated with the APT group Kimsuky, are employing rudimentary tactics such as reply-baiting, where initial emails build rapport before delivering malicious LNK files disguised as PDFs. These attacks often impersonate legitimate entities, like conference organizers, to lure victims. The intelligence sought includes details about the war situation, North Korean military casualties, prisoner handling, and specifically the circumstances surrounding captured North Korean soldiers. Researchers note that the DPRK's shift in targeting from Russian experts to Ukrainian entities suggests a potential lack of direct, accurate information from Russia regarding the conflict's duration. While the methods are not highly sophisticated, the persistent and high-volume nature of these attacks can be taxing for defenders. Attribution remains complex, with some researchers suggesting that distinct North Korean threat groups may be emerging or evolving from larger entities like TA406.
Source: Dark Reading
