Kimsuky pitched fake conferences and research projects to Ukrainian security experts, Genians reports
North Korea's Kimsuky targeted Ukrainian diplomacy and security experts with fake conference invitations, Genians reported Monday. Most observed attempts failed, and Genians' researchers say the aim may be intelligence on the war.
The Watch · Security desk
Exposure map. A Ukrainian security expert was invited to a fake Seoul conference; the August email at first had no malicious links or attachments. A fake European policy researcher sent a malicious archive link after a reply. Operation GitPower uses GitHub, GitLab and Codeberg.
- Who's exposed exposure Ukrainian security expert Invited to speak at a fake Seoul cybersecurity conference, travel and accommodation offered, claim 6
- What it limits constraint August email recipient Genuine conference details, no malicious links or attachments; attackers urged a reply first, claim 7
- Who's exposed exposure Policy report reviewer A fake European policy researcher sent a malicious archive link after the recipient responded, claim 8
- Who's exposed exposure GitHub, GitLab and Codeberg Operation GitPower uses them to distribute malicious files and communicate with compromised systems, claim 12
| Who | How | Kind | Claim |
|---|---|---|---|
| Ukrainian security expert | Invited to speak at a fake Seoul cybersecurity conference, travel and accommodation offered | exposure | 6 |
| August email recipient | Genuine conference details, no malicious links or attachments; attackers urged a reply first | constraint | 7 |
| Policy report reviewer | A fake European policy researcher sent a malicious archive link after the recipient responded | exposure | 8 |
| GitHub, GitLab and Codeberg | Operation GitPower uses them to distribute malicious files and communicate with compromised systems | exposure | 12 |
What happened
- In August, the attackers posed as organizers of a Seoul cybersecurity conference and invited a Ukrainian security expert to speak, offering to cover travel and accommodation.
- In a second case they posed as a European policy researcher asking for feedback on a report about Russia-North Korea military cooperation, then sent a malicious archive link after the target replied.
- Other files were disguised as PDFs and legitimate Zoom installers, and the malware collects data, keeps access and sends stolen information to attacker-controlled infrastructure.
- The activity belongs to Operation GitPower, which uses GitHub, GitLab and Codeberg to distribute malicious files and communicate with compromised systems.
Why it matters
- Who's exposed exposure Any Ukrainian diplomat, security specialist or policy researcher who gets an unsolicited speaking invitation or review request is the entry point, and the first message in the August case had no link or attachment to scan.
- What it limits constraint With files hosted on and traffic going through GitHub, GitLab and Codeberg, a domain block that stops the campaign also cuts off any developer on the same network.
- What it sets up precedent Proofpoint reported TA406 emailing Ukrainian agencies in May 2025 and Genians now reports Kimsuky doing the same; two vendors under two group names point to standing North Korean interest in Ukraine.
Next story · Invest · 1h ago
Trump denies ordering the Starshield speed cap that Musk assigns to WashingtonConfirmed2 publishers
Both email lures Genians describes held back the payload until the target answered [17]. The August invitation also carried genuine details about the conference, and it initially had no malicious link or attachment [7]. We'd expect a mail filter to find nothing to flag in a first message like that. The decision to reply is the control point.
Genians frames the motive as a hypothesis. Its researchers said the attacks "may be aimed at collecting information on the war, the extent of North Korean troop losses, developments in the questioning and handling of prisoners of war, and the details of consultations between South Korea and Ukraine" [4]. The firm added that the September transfer of two captured North Korean soldiers to South Korea could also interest Pyongyang, particularly what the prisoners might disclose about military operations and casualties [5]. Those are assessments of motive. What Genians observed is the lures, the malware and the hosting. The Record's account does not say how many people were targeted or how many attempts got through.
Kimsuky has been active since at least 2012, and its targets have included government bodies, policy institutes, academic researchers and news outlets in the United States, Russia, Japan, Europe and Asia [15]. The U.S. and its Pacific allies sanctioned the group in 2023, accusing it of collecting intelligence to support North Korea's foreign policy and sanctions-evasion efforts [16]. Pyongyang has supplied troops and other military support to Russia since 2024 [14]. Genians also found Japanese-language documents on infrastructure tied to the campaign and said they suggest preparation against Japanese-speaking targets [13].
A second firm has described the same direction of interest. In May 2025, Proofpoint reported that a North Korean-linked group it tracks as TA406 had emailed Ukrainian government agencies, potentially seeking intelligence about the risks facing North Korean troops [10]. Proofpoint said TA406 focuses on political intelligence and strategic analysis of the war, while Russian hackers typically seek tactical intelligence on battlefield operations [11]. Proofpoint uses a different group name from the Kimsuky label Genians applies.
What to watch
- Any count of targets or confirmed compromises from Genians, which has said only that most observed attempts failed.
- Whether another vendor ties Proofpoint's TA406 activity and Genians' Kimsuky activity to the same operator.
- Japanese-language lures from the GitPower infrastructure showing up in attacks on Japanese-speaking targets.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap−10
- Incentives35
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Genians, a South Korean cybersecurity firm, said in a report published Monday that North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy.
- [2]
As part of the campaign, Kimsuky used fake conference invitations, research collaboration requests and malicious documents designed to steal information.
- [3]
Genians researchers said most of the observed attacks were unsuccessful.
- [4]
Genians researchers said: "Kimsuky's attacks against Ukraine may be aimed at collecting information on the war, the extent of North Korean troop losses, developments in the questioning and handling of prisoners of war, and the details of consultations between South Korea and Ukraine."
- [5]
Genians said the September transfer to South Korea of two North Korean soldiers captured by Ukrainian forces could also be of intelligence interest to Pyongyang, particularly what the prisoners might disclose about North Korean military operations and casualties.
- [6]
In an August attack, the hackers impersonated organizers of a cybersecurity conference in Seoul and invited a Ukrainian security expert to speak, offering to cover travel and accommodation expenses.
- [7]
The August email included genuine details about the conference and initially had no malicious links or attachments; the attackers encouraged the recipient to respond before sending additional materials.
- [8]
In another case the hackers posed as a European policy researcher seeking feedback on a report about military cooperation between Russia and North Korea, and after the recipient responded sent a link to a malicious archive disguised as research material.
- [9]
The hackers also used files disguised as PDF documents and legitimate Zoom installers; the malware collects information from infected computers, maintains access and sends stolen information to attacker-controlled infrastructure.
- [10]
In May 2025, Proofpoint reported that a North Korean-linked group tracked as TA406 had been sending malicious emails to Ukrainian government agencies, potentially seeking intelligence about the risks facing North Korean troops fighting alongside Russian forces.
- [11]
According to Proofpoint, TA406's operations in Ukraine focus on political intelligence and strategic analysis of the war, in contrast to Russian hackers, who typically seek tactical intelligence related to battlefield operations.
- [12]
The attacks are part of a broader cyberespionage campaign tracked as Operation GitPower, which uses GitHub, GitLab and Codeberg to distribute malicious files and communicate with compromised systems.
- [13]
Researchers identified Japanese-language documents on infrastructure associated with the campaign, suggesting the hackers may have been preparing attacks against Japanese-speaking targets.
- [14]
North Korea has provided troops to fight in the war in Ukraine as well as other military support to Russia since 2024.
- [15]
Kimsuky has been active since at least 2012, targeting governments, think tanks, academics and media organizations across Asia, Europe, Japan, Russia and the United States.
- [16]
In 2023 the U.S. and its Pacific allies sanctioned Kimsuky, accusing it of collecting intelligence to support North Korea's foreign policy and sanctions-evasion efforts.
- [17]
Both email lures Genians describes (the Seoul conference invitation and the European researcher request) withheld the malicious payload until the target replied.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comNorth Korean hackers target Ukraine for war intelligence
1 article · October 14, 2026
- therecord.mediaNorth Korean hackers target Ukrainian experts for possible intelligence on Russia's war
1 article · October 13, 2026
Topics and entities
Topics
- Phishing
- State-sponsored espionage
- Russia-Ukraine War
Entities
- Operation GitPower
- Kimsuky
- Recorded Future News
- Proofpoint