North Korean hackers have targeted Ukrainian experts in diplomacy, security and international policy in an effort to gather information about Russia’s war against Ukraine, according to a report from South Korean cybersecurity firm Genians.
The hacking group, tracked as Kimsuky, used fake conference invitations, research requests and malicious files to steal information, though most of the observed attacks were unsuccessful.
North Korea has supported Russia’s war effort with troops and other military assistance since 2024. Researchers believe the hackers may be seeking information about the fighting, North Korean troop losses, prisoners of war and discussions between Ukraine and South Korea.
In an August attack, the hackers posed as coordinators of a cybersecurity conference in Seoul and invited a Ukrainian expert to speak. In another case, they pretended to be a European researcher seeking feedback on a report about military cooperation between Russia and North Korea.
The hackers also used fake PDF files and Zoom installers to spread malware that could steal data and give them access to infected computers.
Researchers said the campaign could also be linked to North Korea’s interest in two soldiers captured by Ukrainian forces and transferred to South Korea in September.
The campaign, known as Operation GitPower, has used online platforms to spread malicious files and collect stolen information. Kimsuky has been active since at least 2012 and has targeted governments, researchers, academics and media organizations around the world.