GoKawiilNorth Korean hackers run years-long phishing campaign against Ukrainian officials, researchers say
Security researchers from Genians, Proofpoint, Digital Security Lab Ukraine and Enki White Hat report that North Korean state-linked hacking groups, including one tracked as TA406 (also known as Konni or Opal Sleet), have been spear-phishing Ukrainian government, policy and academic targets since at least February 2025. The campaign aims to gather intelligence on Ukraine's wartime position after North Korea began sending 14,000 to 15,000 troops to support Russia in October 2024.
GoKawiil's interpretation of the reporting above, not reported fact.
The reported activity suggests Pyongyang is using cyber espionage to supplement its battlefield commitment to Russia, giving it independent visibility into Ukraine's war planning rather than relying solely on Moscow. Researchers' description of the effort as clumsy could indicate North Korea's cyber operations are less mature than its troop deployment, though this remains an inference from the pattern of disclosures rather than a stated fact.
- Multiple security firms have tracked North Korean phishing against Ukrainian government and academic targets since early 2025.
- The espionage follows North Korea's October 2024 deployment of roughly 14,000-15,000 troops to aid Russia.
- Groups including TA406/Konni/Opal Sleet have been named by researchers at Proofpoint, Genians, DSLU and Enki White Hat.
YubiKey 5 NFC Security Key — With state-sponsored phishing campaigns like this North Korean operation targeting government and academic users, hardware-based multi-factor authentication is one of the strongest defenses against credential theft. A YubiKey provides phishing-resistant login protection for email and sensitive accounts, making stolen passwords far less useful to attackers.”}
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Nate Nelson, 2026-10-13
Published there as: “North Korea Phishes Ukrainians for War Intel”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.