North Korean Hackers Target Ukraine for War Intelligence via Phishing

• •North Korean hackers are targeting Ukraine for war intelligence using spear-phishing.
• •The attacks are attributed to the Kimsuky APT group and have been ongoing since 2025.
• •Phishing tactics include impersonating legitimate entities to deliver malicious files.

North Korean state-sponsored hackers are conducting spear-phishing campaigns aimed at Ukrainian government, policy, and academic circles to gather intelligence on the Russia-Ukraine war. These attacks, attributed to the APT group Kimsuky, have been ongoing for several years, employing tactics such as baiting emails that impersonate legitimate entities. The intelligence sought includes details on the war situation, North Korean military casualties, and the handling of captured soldiers. The Genians Security Center reports that the DPRK's shift from targeting Russian experts to Ukrainian entities indicates a potential lack of accurate information from Russia. Despite the rudimentary nature of these tactics, the high volume of attacks poses a significant challenge for defenders. Attribution remains complex, with indications that distinct North Korean threat groups may be evolving. Recent reports highlight the persistent nature of these phishing campaigns, which have been noted since at least February 2025.