Loading story…
SOCRadar reported that the DPRK-aligned Konni threat actor, also tracked as TA406, is conducting Operation Conflict Compass against Ukraine-focused organizations. The campaign uses spear-phishing ZIP archives containing malicious Windows shortcut (.LNK) files disguised as PDFs and may also use trojanized Zoom installers to deploy VelvetCake, a custom PowerShell task runner. VelvetCake creates scheduled-task persistence, retrieves PowerShell modules from attacker infrastructure on demand, performs host reconnaissance and screen capture, and exfiltrates collected data.
The operation is assessed, with moderate confidence, to support intelligence collection related to the Russia-Ukraine war and likely targets foreign-policy, diplomatic, defense, and research entities. It follows TA406 activity observed against Ukrainian government organizations in 2025, where lures impersonated think tanks and exploited political themes to deliver credential-harvesting pages or archive-based malware chains; one chain similarly used a benign PDF alongside an LNK that launched encoded PowerShell and created a scheduled task named Windows Themes Update. Organizations should treat unsolicited archives, PDF-like shortcuts, and unexpected Zoom installers as high-risk, and investigate scheduled-task creation and PowerShell execution originating from user download locations.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Public researchers identified samples related to the VelvetCake components in early September 2026.
Command-and-control domains associated with the later Operation Conflict Compass campaign appeared as early as August 3, 2026.
In February 2025, DPRK-linked TA406 targeted Ukrainian government entities with credential-harvesting and malware-delivery phishing campaigns. The activity used spoofed think-tank personas and Ukraine political lures to collect strategic intelligence on the war.
SOCRadar designated Operation Conflict Compass as a Ukraine-focused cyberespionage campaign assessed with moderate confidence to be operated by DPRK-aligned Konni/TA406. The operation used spear-phishing ZIP attachments containing PDF-disguised LNK files and suspected trojanized Zoom installers to deploy the VelvetCake PowerShell task runner.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcesocradar.io
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple reports documented continued **KONNI** activity using spear-phishing lures tied to geopolitics, cryptocurrency, and regional news, with malware delivered through malicious Word documents, VBA macros, staged DLL payloads, and fake software components. Campaigns used North Korea-themed decoys such as CNN and Yonhap articles, later shifted to Russian-language and Huobi-themed documents, and commonly installed both 32-bit and 64-bit payloads, persisted through `rundll32.exe`, Windows Run registry keys, scheduled tasks, and downloader chains that fetched additional malware from attacker-controlled HTTP, FTP, and staged web infrastructure disguised as legitimate sites. Technical analysis showed the malware family evolving from earlier XOR-protected communications to ZIP-compressed, **RC4**-encrypted, Base64-encoded exfiltration, while retaining capabilities including reconnaissance, file theft, screenshot capture, keylogging, clipboard theft, and payload execution. Later reporting linked the KONNI ecosystem to broader North Korea-aligned operations, citing overlaps with **Kimsuky/Thallium** in infrastructure, malware formats, credentials, and delivery tradecraft, and describing newer campaigns in South Korea that used compromised KakaoTalk accounts, multiple RAT families, and stolen Google credentials to abuse Android **Find Hub** for device tracking and remote wiping of victims’ phones.
Aug 15, 2026
**KONNI**, a North Korea–aligned threat actor active since at least 2014, has been linked to an ongoing phishing campaign targeting **software developers and engineering teams** with access to **blockchain/crypto** resources across the **Asia-Pacific** region, including **Japan, Australia, and India**. The operation uses convincing project documentation (e.g., detailed requirement papers and product briefs describing trading bots, credential systems, and delivery roadmaps) to build trust with technical staff and increase the likelihood of execution. The infection chain uses **PDF-themed lures** delivered alongside **malicious Windows shortcut (`.lnk`) files** (often inside ZIP archives) that trigger an embedded **PowerShell loader**, ultimately deploying an **AI-written PowerShell backdoor**. Reporting notes the backdoor is unusually “developer-like” (clean structure and extensive comments) and includes capabilities such as host reconnaissance (hardware/system details), anti-analysis checks (e.g., debugging tool detection), and single-instance execution controls—raising the risk of follow-on compromise of **source code repositories, cloud consoles, signing keys, and build/CI pipelines** if developer endpoints are breached.
Jun 29, 2026
North Korea-linked threat group **Kimsuky** has been reported using malicious Windows shortcut (`.LNK`) files to initiate a **multi-stage infection chain** that ends with deployment of a **Python-based backdoor**. Reporting shared from both AhnLab and Excalibra indicates the campaign relies on weaponized LNK files as the initial access vector, with the malware delivery process evolving from earlier distribution patterns. The activity was attributed to Kimsuky in threat-intelligence reporting and social media amplification, with references also linking the cluster to **DPRK** operations and possible overlap or comparison with **Konni** tracking. While the cited summaries did not include victimology or technical indicators, they consistently described a shift in how the group distributes malware and highlighted the use of LNK-based social engineering to stage follow-on payloads.
Jun 30, 2026