The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple -baiting phishing attacks.
North Korean state-sponsord hackers are spear-phishing government, policy, and academic circles in Ukraine to pilfer intelligence the country's own position in the Russia-Ukraine war .
The Democratic People's Republic of Korea (DPRK) joined the Russian war effort in Ukraine in October 2024. It supported its ally most notably by sending around 14,000 to 15,000 troops to the front lines. It didn't all go to plan, though. For example, Ukraine transferred two North Korean prisoners of war to South Korea.
To keep apprised of all that's happening 4,000 miles away, North Korean threat actors have been targeting Ukrainian organizations and individuals with phishing attacks to gather intelligence. According to South Korea-based Genians Security Center, this espionage campaign has been going on for some years now. And like the rest of the DPRK's war effort, though, it appears to be a bit clumsy.
Related: ASOS Breach Reveals the Risks in Customer-Facing SaaS
DPRK Espionage Develops in Ukraine
For a couple of years now, different research groups have been picking up on evidence of North Korean hackers targeting Ukraine.
First, Proofpoint researchers revealed that hackers associated with the North Korean government had been lobbing spear-phishing attacks at Ukrainian government agencies. The activity dated back at least to February 2025, only a few months after Kim Jong-Un's war aid began. Proofpoint tracked the actor as TA406 , overlapping with the group better known as Konni or Opal Sleet.
In August 2026, the Digital Security Lab Ukraine (DSLU), a non-governmental organization (NGO), investigated a spear-phishing attack against a Ukrainian civil service member. It didn't attribute a particular threat actor, but made special note that "this is not an isolated incident."
And last month, at the Korea Cyber Security Conference (KSCON) 2026 in Seoul, a researcher from local firm Enki White Hat described tactics, techniques, and procedures (TTPs) he associated with North Korea's advanced persistent threat (APT) "Kimsuky." The presentation focused on continuing attacks against South Korean targets in particular.
In a blog post published on Sunday, Genians merged all of these separate findings into a single, cohesive picture — a Kimsuky campaign designed to target war intelligence out of Ukraine. More specifically, the researchers wrote that Kimsuky is gathering information "the war situation, the extent of North Korean military casualties, trends in prisoner investigation and handling," and, in particular, details surrounding the situation of those two soldiers sent from Ukraine to South Korea.
Related: Venezuelan Cartel's Malware Honcho Nabbed for ATM Jackpotting
Ironically, "Before they shifted to targeting Ukraine, they were really interested in Russian experts in the West," Greg Lesnewich, principal threat research engineer at Proofpoint notes. "They would target Russia-related experts to try to understand potentially what Russia is thinking."
Lesnewich says the shift could be an indication that DPRK officials aren't getting the straight story from the Russian government.
"My suspicion that is that Russia wouldn't tell them how long their troops were going to be in Ukraine, because they didn't have a timetable. So they went to target entities in Ukraine, to see if there was some estimate they could get for how long Ukraine might hold out," he speculates.
What Kimsuky Phishing Attacks Look Like
It may all sound rather grand but, in practice, the attacks themselves are rudimentary.
The best tactic the threat actor has going for it might be -baiting. Instead of sending transparent phishing emails with malware attached, it sends relatively inoffensive initial greetings meant to build a rapport with the target, and sneak through email security barriers.
For instance, the researchers identified a spear-phishing attack aimed at Ukrainian foreign affairs and security experts, in which the attackers impersonated the organizing committee of KSCON 2026. The emails included real event details and references to the recipient's area of expertise, and offered compensation for flights and accommodations, plus a presentation fee, if the recipient would only visit to be a guest speaker. If victims replied to this attractive offer they then were served their official "invitation": a malicious shortcut (LNK) file, masked as a PDF via a PDF icon and double extension (".pdf.lnk").
Related: Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
Besides -baiting, the activity Genians attributes to Kimsuky involves some very basic command obfuscation , scheduled tasks for persistence, and scripts, documents, and commands hosted via public repository services like GitHub and GitLab. Like other lazy hackers, the group has been experimenting with large language models (LLMs), the researchers wrote. Its recent attacks have also been peppered with pretty obvious errors, like emails inviting victims to Google Meet calls that actually contain Zoom links.
"They aren't innovators in this space. They are a middle-of-the-road kind of actor," Lesnewich says. "We saw a couple of times where they were observing some other threat actor — potentially from public blogging — using a certain infection chain, and then they would borrow from that and use it against their targets."
Luckily for organizations, these less inspiring North Korean threat actors can be spotted pretty easily. "We don't have to do a lot to hunt for them. It's just the pace and the volume can really wear you down," he acknowledges.
Threat Actors Diverge, Muddy Attribution
Lesnewich tells Dark Reading that the threat actor it tracks as TA406 seems less active in 2026 than 2025, having been particularly quiet during the summer, though that may be because it's evolving. Some newer, lesser defined groups "almost feel like pieces of TA406, going off in different directions," he says. For instance, Proofpoint associates the GitHub-related attack chain described in Genians' new blog with an as yet unnamed threat actor.
"One of these subclusters that we're seeing we call "Honeycrisp," he continues, noting that the designation is only temporary.
With Honeycrisp, "We're actually seeing a good amount of targeting of education, and, particularly, either spoofing or targeting former diplomats who have landed in places like higher education or think tanks. So we're kind of seeing two clusters: TA406, doing the same things Genians saw. And then we have another that is doing stuff that's also similar, but with vastly different targeting."
Without commenting on Genians' attribution specifically, Lesnewich argues that cybersecurity analysts in general have been somewhat imprecise in grouping possibly distinct North Korean actors into general buckets.
"We'll make the distinction for Russian APTs — that a Sandworm-related actor handed off access to an APT28 -related actor. But for some reason, with North Korea , it's all just thrown into 'If it's kind of good [TTPs] it's Lazarus, and if it's kind of bad, it's Kimsuky,'" he laments.
"My working theory," Lesnewich says, "is that the reorganization from the Reconnaissance General Bureau (RGB) [DPRK's intelligence agency] in early 2026, plus North Korea's regular shuffling of operators and people — at least as best we can kind of tell, since this is from the outside looking in — [caused] a shake-up of the historic kinds of lines being drawn, where 'this' is what designates one actor and 'this' is what designates another one."
Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media.
He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify.
He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself.
Want more Dark Reading stories in your Google results?
The State of Cloud Security: The Latest Challenges
The State of Cloud Security: The Latest Challenges
How Organizations Are Managing Incident Response
How Organizations Are Managing Incident Response
How Enterprises Are Developing Secure Applications
How Enterprises Are Developing Secure Applications
Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy
Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy
Essential News & Insights from Black Hat USA 2025
Essential News & Insights from Black Hat USA 2025
How to Harness your Security Operations Data for Enterprise Defense
How to Harness your Security Operations Data for Enterprise Defense
Building Cyber Resilience: Beyond Prevention to Recovery
Building Cyber Resilience: Beyond Prevention to Recovery
The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy
The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy
Static Analysis, Smarter Triage, Agentic Depth: A Practical AppSec Stack for AI-Driven Development
Static Analysis, Smarter Triage, Agentic Depth: A Practical AppSec Stack for AI-Driven Development
Effective Alert Triage: Reducing Noise and Finding Real Threats
Effective Alert Triage: Reducing Noise and Finding Real Threats
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
