North Korean hackers target Ukrainian experts for possible intelligence on Russia's war

North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy amid Pyongyang’s growing military cooperation with Russia, according to a new report.

As part of the campaign, the hacking group Kimsuky used fake conference invitations, research collaboration requests and malicious documents designed to steal information, South Korean cybersecurity firm Genians said in a report published Monday. 

North Korea has provided troops to fight in the war in Ukraine as well as other military support to Russia since 2024. 

"Kimsuky’s attacks against Ukraine may be aimed at collecting information on the war, the extent of North Korean troop losses, developments in the questioning and handling of prisoners of war, and the details of consultations between South Korea and Ukraine,” researchers said, adding that most of the observed attacks were unsuccessful.

Genians said the transfer of two North Korean soldiers captured by Ukrainian forces to South Korea in September could also be of intelligence interest to Pyongyang, particularly what the prisoners might disclose about North Korean military operations and casualties.

Operation GitPower

In one attack in August, the hackers impersonated organizers of a cybersecurity conference in Seoul and invited a Ukrainian security expert to speak at the event.

The email included genuine details about the conference and offered to cover travel and accommodation expenses. It initially did not contain malicious links or attachments. Instead, the attackers encouraged the recipient to respond before sending additional materials.

In another case, the hackers posed as a European policy researcher seeking feedback on a report about military cooperation between Russia and North Korea. After the recipient responded, the attackers sent a link to a malicious archive disguised as research material, according to Genians.

The hackers also used files disguised as PDF documents and legitimate Zoom installers to trick recipients into running malicious software. The malware was designed to collect information from infected computers, maintain access to compromised systems and send stolen information to infrastructure controlled by the attackers.

Researchers also identified Japanese-language documents on infrastructure associated with the campaign, suggesting the hackers may have been preparing attacks against Japanese-speaking targets.

These attacks are part of a broader cyberespionage campaign tracked as Operation GitPower, which uses legitimate software development platforms, including GitHub, GitLab and Codeberg, to distribute malicious files and communicate with compromised systems, researchers said.

Broader espionage campaign

Kimsuky has been active since at least 2012, targeting governments, think tanks, academics, and media organizations across Asia, Europe, Japan, Russia and the United States. In 2023, the U.S. and its Pacific allies imposed sanctions on the group, accusing it of collecting intelligence to support North Korea’s foreign policy and sanctions-evasion efforts.

In May 2025, cybersecurity firm Proofpoint reported that a North Korean-linked group tracked as TA406 had been sending malicious emails to Ukrainian government agencies, potentially seeking intelligence about the risks facing North Korean troops fighting alongside Russian forces.

According to Proofpoint, TA406’s cyber operations in Ukraine focus on political intelligence and strategic analysis of the war, in contrast to Russian hackers, who typically seek tactical intelligence related to battlefield operations.