Genians, a South Korean security firm, says North Korean hackers are targeting Ukrainian experts in diplomacy, security and policy. Its report came out Monday, The Record reported. Genians names the group as Kimsuky. In August, one email posed as a Seoul cybersecurity conference and offered a Ukrainian security expert a speaking slot, with travel costs paid. In another case, the sender pretended to be a European researcher who wanted feedback on a report about Russia and North Korea. The attackers also used files dressed up as PDFs and Zoom installers.
Genians said most of the attacks it observed failed. It believes the aim may be news on the war, North Korean troop losses, prisoners of war, and talks between South Korea and Ukraine. That is the firm's view, not a proven motive. The Record's account does not say how many people were targeted or whether any data was stolen. Genians also found Japanese-language documents on systems tied to the campaign. It says this may mean attacks on Japanese speakers were being prepared.
Genians links the campaign to Operation GitPower. It uses GitHub, GitLab and Codeberg, which are sites where developers share code, to spread malicious files and to control infected machines. The August conference email held no link or file, and the sender asked for a reply first. For teams that build or run software, both a harmless-looking first message and a well-known code site can be part of an attack.