South Korean firm Genians (report published Monday) said North Korean state-sponsored group Kimsuky has been targeting Ukrainian experts in diplomacy, security and international policy for intelligence on Russia's war with Ukraine, which North Korea has supported with troops and materiel since 2024. The campaign uses fake conference invitations, research-collaboration requests and weaponised documents — including a lured story posing as a cybersecurity-conference organiser in Seoul and a European policy researcher seeking feedback on Russia–North Korea cooperation — then delivers malicious archives, PDFs and Trojansed Zoom installers. The malware collects data, maintains access and exfiltrates to attacker infrastructure, with the cluster tracked as Operation GitPower for heavy use of legitimate developer platforms (GitHub, GitLab, Codeberg) to distribute files and communicate with compromised systems. Attacks are reported as largely unsuccessful, but the targeting of Ukrainian security experts and the questioning of North Korean POWs (two transferred to South Korea in September) underscores intelligence interest. Proofpoint characterises the operation as political/strategic intelligence collection, distinct from Russian tactical battlefield targeting.

• Source article