Kimsuky hides wartime espionage in ordinary outreach
Genians says Kimsuky ran a new campaign against Ukrainian diplomacy, security, and policy experts with fake conference invitations, research collaboration requests, and malicious documents; most of the observed attempts failed. The apparent goal was to collect intelligence on Russia’s war, including troop losses, prisoner-of-war handling, and related consultations.
The lure worked by looking like normal professional correspondence. In one case the attackers waited for a reply before sending more material; in others they used disguised PDFs, research archives, and even legitimate Zoom installers to deliver malware that could steal data and keep access to infected systems. That means simple filters for bad links or obvious attachments miss the handoff that matters.
For government, defense, and think-tank teams working on Ukraine or Russia, the exposure sits in strategic correspondence itself: a conference invite or collaboration request can be the delivery path, not just background noise. What this changes is the trust picture around ordinary outreach, especially where wartime research or POW-related material is in play.
The Democratic People's Republic of Korea (DPRK) is trying to get insight into its war effort in Ukraine, through simple reply-baiting phishing attacks.
North Korean hackers target Ukrainian experts for possible intelligence on Russia's war
North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy amid Pyongyang’s growing military cooperation with Russia.