North Korea's Kimsuky targets Ukrainian policy experts with fake conference invites

North Korean state-backed hacking group Kimsuky has been targeting Ukrainian experts in diplomacy, security and international policy, according to a report by South Korean cybersecurity company Genians covered by The Record. Genians tracks the activity as Operation GitPower and assesses that it may be aimed at collecting intelligence on Russia's war in Ukraine, including North Korean troop losses and the handling of North Korean prisoners of war. Genians published its findings on October 12, according to The Record. Most of the observed attacks were unsuccessful.

What happened

According to The Record, the attackers relied on multi-stage social engineering, building trust with targets before sending anything malicious. In one example from August 2026, a target received a fake invitation from supposed organizers of a cybersecurity conference in Seoul, offering to cover travel and accommodation costs. The first email contained no links or attachments and simply asked the recipient to reply.

Another lure came from a fake European policy researcher who asked for feedback on a report about Russia-North Korea military cooperation. That was followed by a malicious archive disguised as research material. The Record reports that the attackers also used files disguised as PDF documents and legitimate Zoom installers.

Technical details

Genians found that the group abused legitimate developer platforms, namely GitHub, GitLab and Codeberg, both to distribute malicious files and to communicate with compromised systems, The Record reports. The malware collects information from infected computers, keeps access to them and sends stolen data to attacker-controlled infrastructure. The Record's article does not name specific malware families or list indicators of compromise; those are in the full Genians report.

The Record also notes that Japanese-language documents were found in the campaign's infrastructure, which could point to future targeting of Japanese speakers. Genians suggests the September transfer of two captured North Korean soldiers to South Korea could be of particular interest to Pyongyang.

Background

Kimsuky has been active since at least 2012 and was sanctioned by the US and its Pacific allies in 2023, according to The Record. In May 2025, Proofpoint reported that a related cluster it tracks as TA406 was targeting Ukrainian government agencies. Proofpoint said those operations focused on "political intelligence and strategic analysis of the war."

What to do

Researchers, diplomats and think tank staff working on Ukraine, Russia or the Korean Peninsula should:

• Be wary of unsolicited conference invitations and research collaboration requests, especially ones that first ask only for a reply.
• Check file extensions carefully. Shortcut or executable files disguised as PDFs are a common Kimsuky tactic.
• Download software such as Zoom only from official vendor sites.
• Ask security teams to monitor unusual connections from workstations to code hosting platforms such as GitHub, GitLab and Codeberg.