Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
Phishing Campaigns Appear to Be Solely Intelligence-Gathering for DPRK Leadership
North Korea nation-state hackers appear to have entered into the Ukrainian cyber operations fray.
See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It
Beginning in February, cybersecurity firm Proofpoint said it began seeing phishing campaigns targeting Ukrainian entities designed for credential harvesting as well as to infect endpoints with malware. Researchers attributed the attacks to the North Korean advanced persistent threat group tracked as TA406, aka Kimsuky, Thallium, Opal Sleet and Konni.
The phishing emails have included fake security alerts disguised as Microsoft notifications, sent to Ukrainian government agencies from Proton Mail accounts sporting the usernames “Microsooft” and “Microft Acount Tearns.”
Other phishing emails arrive with HTML attachments designed to download a .zip archive that contains a “benign PDF” file as well as a Windows Shortcut File named Why Zelenskyy fired Zaluzhnyi.lnk which, if run, executes PowerShell code. This drops a Windows scheduler task named “Windows Themes Update” which leads to the next stage of the attack, which researchers said they were unable to recover.
Based on the campaigns and attack infrastructure used, North Korean threat actors are likely “targeting Ukrainian government entities to better understand the appetite to continue fighting against the Russian invasion and assess the medium-term outlook of the conflict,” Proofpoint said. The cyberespionage operation “is very likely gathering intelligence to help North Korean leadership determine the current risk to its forces already in the theater, as well as the likelihood that Russia will request more troops or armaments.”
Western officials estimate that North Korean Supreme Leader Kim Jong Un has dispatched about 11,000 troops to fight for Russia. South Korean officials said he later sent about 3,000 replacements for soldiers captured, killed or injured in the fighting, especially along the Kursk border.
Russia and North Korea only officially confirmed two weeks ago that North Korean troops have been fighting on Russia’s behalf in the Ukrainian theater of war, as part of a strategic partnership agreement Kim signed with Moscow in June 2024.
“The Russian people will never forget the heroism of the Korean special forces,” Russian President Vladimir Putin said in a statement. “We will always honor the Korean heroes who gave their lives for Russia and for our shared freedom, alongside their brothers-in-arms from the Russian Federation.”
How the war might end remains an open question.
“Only 30% of wars between states end with a victory by either side,” Center for Strategic Studies’ researchers Benjamin Jensen and Jose Macias wrote in a November 2024 report.
Overall, “31% of high intensity interstate wars end in a stalemate under ceasefire agreements, which halts large-scale violence but leaves underlying disputes unresolved,” they wrote. “This trend underscores the probability of a ‘frozen conflict’ for Ukraine, where active hostilities might subside without a formal peace, potentially stabilizing frontlines but leaving the core conflict unresolved.”
Many world leaders have been working to resolve the conflict via a peace deal that includes security guarantees for Ukraine.
Before winning his second presidential election, U.S. President Donald Trump boasted that he’d see a peace deal signed between Moscow and Kyiv on “day one” of his new term.
Last month, marking 100 days in office, Trump revised that assessment. “Well, I said that figuratively, and I said that as an exaggeration” and “to make a point,” he told TIME magazine. “Obviously, people know that when I said that, it was said in jest,” although he reiterated that the war “will be ended.”
Russia remains noncommittal.
European leaders threatened to levy additional sanctions on Moscow starting Monday, unless Russia abided by a 30-day ceasefire. Those sanctions have now been paused as European leaders waited to see if Moscow quickly committed to the ceasefire. Putin told reporters Sunday at the Kremlin that he has suggested resuming peace talks in Istanbul, working directly with Russia’s Ukrainian counterparts, to commence Thursday, Sky News reported. A Russian official later clarified that Putin said the preconditions that led to the war must first be addressed before any end to the conflict could be negotiated.
Critics have accused Putin of continuing to stall in the service of further Russian military action designed to occupy more Ukrainian territory.
Ukrainian President Volodymyr Zelenskyy, in a Sunday post to social platform X, promised to be in Istanbul, and invited U.S. President Donald Trump to play an in-person role there too.
A bipartisan Senate bill introduced last month by Republican Sen. Lindsey Graham and Democratic Sen. Richard Blumenthal would introduce a raft of sanctions against Russia unless it commits to “good faith negotiations for a lasting peace with Ukraine” and avoids any efforts, including military activities, that would undermine “the sovereignty of Ukraine after peace is negotiated.”
Graham promised to introduce a new bill this week designed to impose “hellish sanctions” on Russia, including against its energy and banking sectors, unless it sits down at the negotiating table.
link