North Korean hackers linked to the Kimsuky group have been running a targeted espionage campaign against Ukrainian experts in diplomacy, security, and international policy, according to a report from South Korean firm Genians. The attackers posed as conference organizers and researchers, sending invitations and collaboration requests that eventually led to malicious files designed to steal information. Most attempts were unsuccessful, but the intent was clear: to collect intelligence on the war, North Korean troop losses, prisoner handling, and consultations between South Korea and Ukraine.
The report ties these attacks to a broader operation called GitPower, which abuses legitimate software development platforms like GitHub and GitLab to distribute malware and maintain control over compromised systems. In one case, hackers impersonated a cybersecurity conference in Seoul; in another, they posed as a European policy researcher. The malware, once installed, could exfiltrate data and keep persistent access to infected machines.
These findings echo a May 2025 report from Proofpoint, which identified a North Korean-linked group (TA406) sending malicious emails to Ukrainian government agencies. Both sources point to a strategic focus on political and war-related intelligence, distinct from the tactical battlefield data that Russian hackers typically seek. The Genians report also notes Japanese-language documents on the attackers' infrastructure, suggesting possible future targeting of Japanese-speaking victims.