North Korean Hackers Target Ukrainian Experts in Espionage Campaign
North Korean state-sponsored hackers, identified as Kimsuky, are targeting Ukrainian experts in diplomacy and security with sophisticated phishing tactics to gather intelligence on the Russia-Ukraine war.
North Korean state-sponsored hacking group Kimsuky has been actively targeting Ukrainian experts in fields such as diplomacy, security, and international policy. This campaign, detailed in a report by South Korean cybersecurity firm Genians, appears to be aimed at gathering intelligence related to the ongoing conflict between Russia and Ukraine, a conflict in which North Korea has increased its military cooperation with Russia.
The attackers employed a variety of social engineering tactics, including fake conference invitations and requests for research collaboration. In one instance, hackers impersonated organizers of a Seoul-based cybersecurity conference, inviting a Ukrainian security expert to speak and offering to cover travel expenses. Initially, these emails did not contain malicious links or attachments, but attackers would follow up with additional materials after receiving a response.
In another observed attack, Kimsuky posed as a European policy researcher seeking feedback on a report concerning Russia-North Korea military cooperation. Upon engagement, the target was sent a link to a malicious archive disguised as research material. The group also utilized files masquerading as legitimate PDF documents and Zoom installers to trick recipients into executing malware.
The malware deployed in these attacks is designed to exfiltrate information from compromised systems, maintain persistent access, and transmit stolen data to infrastructure controlled by the attackers. Genians researchers also noted the presence of Japanese-language documents associated with the campaign, suggesting potential preparations for attacks targeting Japanese-speaking individuals.
These activities are part of a broader cyberespionage operation known as Operation GitPower. This operation leverages legitimate software development platforms like GitHub, GitLab, and Codeberg for distributing malicious files and for command-and-control communications with compromised systems. This method allows the attackers to blend in with normal development traffic, making detection more challenging.
The Kimsuky group has a long history of cyberespionage, dating back to at least 2012. Their targets have typically included governments, think tanks, academics, and media organizations across various continents. In 2023, the United States and its allies imposed sanctions on Kimsuky, citing its role in collecting intelligence to support North Korea's foreign policy objectives and efforts to evade international sanctions.
This latest wave of attacks against Ukrainian experts is particularly noteworthy given the increasing military and political ties between North Korea and Russia. The intelligence gathered could provide Pyongyang with insights into troop movements, casualty figures, prisoner of war handling, and diplomatic discussions between South Korea and Ukraine, potentially influencing its strategic decisions and its support for Russia's war efforts.