Fake Conference Invites and Research Requests: How North Korea's Kimsuky Group Is Targeting Ukrainian Experts

North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy, according to a report published Monday by South Korean cybersecurity firm Genians. The group, known as Kimsuky, used fake conference invitations, research collaboration requests and malicious documents designed to steal information. Researchers said the aim may be to gather intelligence on the war, North Korean troop losses, the handling of prisoners of war, and talks between South Korea and Ukraine. Most of the observed attacks were unsuccessful.

The approaches were patient and convincing. In August, the attackers posed as organisers of a cybersecurity conference in Seoul and invited a Ukrainian security expert to speak. The email contained genuine conference details and offered to cover travel and accommodation. It had no malicious links or attachments at first; the attackers simply urged the recipient to reply before sending more material. In another case, they posed as a European policy researcher seeking feedback on a report, then sent a link to a malicious archive disguised as research material after the target responded.

Genians also found files disguised as PDF documents and legitimate Zoom installers, used to trick people into running malware. The malware was designed to collect information, maintain access to infected systems and send stolen data to attacker-controlled infrastructure. Japanese-language documents found on related infrastructure suggest Japanese-speaking targets may also be in view.