North Korea’s Kimsuky is email‑pitching Ukraine’s experts

North Korean hackers are phishing Ukrainian experts with emails that look like real conference invites and research collaborations, then pivoting to malware once a reply lands. A report from South Korean cybersecurity firm Genians says the group Kimsuky is behind the push, and that most attempts it observed failed—but the tradecraft is getting sharper (report summary via The Record).

The targets, Genians says, are Ukrainians in diplomacy, security and international policy—exactly the people likely to hold analysis of battlefield dynamics and foreign consultations that Pyongyang wants. Researchers added that North Korea’s interest likely extends to the fate of its own troops fighting alongside Russia since 2024, including losses and prisoner handling.

One August lure impersonated organizers of a cybersecurity conference in Seoul and invited a Ukrainian security expert to speak. The email contained genuine details, promised to pay travel and accommodation, and—crucially—initially carried no malicious link or attachment. The ask was to “please reply,” which the attackers used to introduce next‑step materials, according to Genians.

In another case, the sender posed as a European policy researcher and asked for feedback on a report about Russia–North Korea military cooperation. Only after the recipient responded did the attackers share a link to a malicious archive disguised as research, the firm said.

The payloads weren’t limited to archives. Genians observed files disguised as PDFs and legitimate Zoom installers that, when run, deployed malware designed to collect data, keep access and exfiltrate to attacker‑controlled infrastructure. That multi‑format approach complicates attachment policies that look for just one risky file type.

Genians links these activity clusters to Operation GitPower, a broader espionage campaign that uses developer platforms including GitHub, GitLab and Codeberg to distribute malicious files and communicate with infected hosts. That choice matters: developer tooling often sits on allowlists, and outbound traffic to those domains can blend with normal work.

Researchers also found Japanese‑language documents on infrastructure associated with the campaign, suggesting future targeting of Japanese‑speaking users. That matches Kimsuky’s long‑running habit of moving across regions and languages to hit governments, think tanks, academics and media beyond a single country.

Kimsuky has operated since at least 2012, with activity documented across Asia, Europe, Japan, Russia and the United States. In 2023, the U.S. and Pacific allies sanctioned the group, accusing it of collecting intelligence to prop up North Korea’s foreign policy and evade sanctions. Sanctions don’t erase capability; they signal that cyber operations are central to state objectives.

The lure themes line up with recent geopolitical events. Genians notes that in September, Ukraine transferred two captured North Korean soldiers to South Korea—an incident Pyongyang would have strong incentives to research for insights into disclosures about its military operations and casualties.

Proofpoint reported in May 2025 that another North Korean‑linked actor, TA406, sent malicious emails to Ukrainian government agencies. Its assessment: TA406 is chasing political intelligence and strategic analysis of the war, while Russian groups more often hunt for tactical battlefield data. Multiple actor sets with different goals raise defenders’ workload.

The Kimsuky campaign leans into a now‑familiar tactic: reply‑baiting with legitimate‑sounding detail and no initial payload. We’ve covered how defenders are shifting from static signals to reading context and intent across interactions; Proofpoint’s own product pitch stresses intent‑aware controls spanning email, inbox and browser (our coverage).

This campaign also underscores how modern phishing piggybacks on legitimate cloud services. A recent industry takedown showed how attackers weaponized mainstream cloud accounts to push over a billion malicious messages, revealing the scale enabled by trusted infrastructure (background on cloud‑backed phishing infrastructure).

Malware delivery through common attachments and installers remains a frontline problem for mail gateways. Cisco’s patch this year for an email gateway zero‑day exploited through attachments was a reminder that even security layers can become paths to compromise if not fast‑patched (CVE‑2026‑76519 context).

The Record’s write‑up of Genians’ research emphasizes that most attempts the firm tracked did not succeed. That’s good news for defenders in Ukraine’s knowledge sector, but it also shows the long game: patient social engineering, credible pretexts, and infrastructure that looks like everyday productivity.

Kimsuky’s targeting fits a decade‑long pattern of focusing on analysis more than brute access to military systems. Think tanks, academics and media have long been in scope; now, Ukrainian policy experts carry especially valuable context on how the war is perceived, discussed and negotiated.

Because the first message often looks clean, common filters that flag links or executables at time‑of‑delivery can miss the handover when a payload shows up later in the thread. That gap is where user training, thread‑level analytics and stricter handling of unsolicited follow‑ups come in.

Developer platforms as command‑and‑control add another wrinkle. Even organizations with tight email controls may not monitor for abnormal Git operations, archive downloads from personal Codeberg links, or outbound beacons to gist‑like endpoints that imitate everyday dev workflows.

For targets outside Ukraine, the Japanese‑language findings hint at potential expansion. Past Kimsuky activity has touched Europe, Japan and the U.S., and the themes here—conferences, peer review, cross‑border collaboration—travel easily across academic and policy communities.

None of this suggests abandoning the basics. Multi‑factor authentication limits the blast radius after credential theft; attachment sandboxes and blocking of unsigned installers reduce drive‑by execution; and clear escalation paths help staff verify unexpected invites before engaging.

If you need a refresher on the broader security landscape for email, our security hub tracks where social engineering meets infrastructure, from intent‑aware controls to the cloud accounts that fuel large‑scale phishing.

What happened

• Genians reported that North Korea’s Kimsuky targeted Ukrainian experts in diplomacy, security and international policy with tailored email lures that began as legitimate‑looking invites and collaboration requests (The Record summary).

• After initial replies, the attackers introduced malicious archives, files disguised as PDFs, and Zoom installers that deployed malware to gather information and maintain access, Genians found.

• The activity is part of Operation GitPower, which routes payload hosting and command‑and‑control through GitHub, GitLab and Codeberg—services commonly allowed inside organizations.

• Genians observed Japanese‑language documents on related infrastructure, indicating possible preparation for attacks against Japanese‑speaking targets outside Ukraine.

• The firm assessed that most attempts it tracked were unsuccessful, but said the likely goals included war intelligence, details on North Korean troop losses, POW handling, and South Korea–Ukraine consultations.

The background

• Kimsuky has operated since at least 2012, routinely targeting governments, think tanks, academics and media across Asia, Europe, Japan, Russia and the United States, according to public reporting summarized by The Record.

• The U.S. and Pacific allies sanctioned Kimsuky in 2023, accusing it of collecting intelligence in support of North Korea’s foreign policy and sanctions‑evasion operations.

• North Korea has provided troops and other military support to Russia since 2024, raising Pyongyang’s interest in Ukraine‑related intelligence—including its own forces’ situation and treatment.

• In May 2025, Proofpoint reported that TA406, a separate North Korean‑linked group, emailed Ukrainian government agencies with malicious messages aimed at political intelligence and strategic war analysis—distinct from Russian actors’ more tactical collection.

• In September, two captured North Korean soldiers were transferred by Ukraine to South Korea, an event Genians flagged as likely to sharpen Pyongyang’s intelligence requirements around POWs and disclosures.

What people are saying

• Genians researchers wrote that "Kimsuky’s attacks against Ukraine may be aimed at collecting information on the war," including losses, POW handling, and South Korea–Ukraine consultations.

• The firm said the emails sometimes arrived without initial malicious content, encouraging a response before delivering files or links—an approach that strains first‑message filters and pushes detection into later reply stages.

• Proofpoint assessed in May 2025 that TA406’s Ukraine focus is political and strategic, contrasting with Russian operators’ typical hunt for battlefield tactics—evidence that multiple adversaries are sifting different layers of the same conflict.

• The Record noted Genians’ finding that most tracked attempts fell short, a reminder that layered defenses and user skepticism still blunt targeted social engineering.

• Operation GitPower’s use of GitHub, GitLab and Codeberg is a deliberate choice to hide in sanctioned traffic to developer platforms—behavior defenders increasingly monitor after large‑scale cloud abuse campaigns exposed their role in phishing at scale (our explainer on cloud‑abuse takedowns).

What happens next

• Expect more reply‑baiting where the first email is clean and the payload arrives only after engagement. Security teams should add thread‑aware checks and educate high‑value roles on conference and peer‑review pretexts.

• Watch for exfiltration and command‑and‑control using developer platforms. Blocking is rarely practical; visibility, anomaly detection, and egress policy tuning are the workable steps.

• Given Kimsuky’s regional range and the Japanese‑language artifacts, similar lures could hit think tanks and policy circles beyond Ukraine. Cross‑org verification norms for invites and collaborations can reduce risk.

• Vendors are leaning into intent‑aware defenses across channels; Proofpoint’s strategy to connect email, inbox and browser controls aims at exactly this pattern of low‑signal social engineering (our coverage of intent‑reading defenses).