North Korean state-sponsord hackers are spear-phishing government, policy, and academic circles in Ukraine to pilfer intelligence about the country's own position in the Russia-Ukraine war.
The Democratic People's Republic of Korea (DPRK) joined the Russian war effort in Ukraine in October 2024. It supported its ally most notably by sending around 14,000 to 15,000 troops to the front lines. It didn't all go to plan, though. For example, Ukraine transferred two North Korean prisoners of war to South Korea.
To keep apprised of all that's happening 4,000 miles away, North Korean threat actors have been targeting Ukrainian organizations and individuals with phishing attacks to gather intelligence. According to South Korea-based Genians Security Center, this espionage campaign has been going on for some years now. And like the rest of the DPRK's war effort, though, it appears to be a bit clumsy.
DPRK Espionage Develops in Ukraine
For a couple of years now, different research groups have been picking up on evidence of North Korean hackers targeting Ukraine.
First, Proofpoint researchers revealed that hackers associated with the North Korean government had been lobbing spear-phishing attacks at Ukrainian government agencies. The activity dated back at least to February 2025, only a few months after Kim Jong-Un's war aid began. Proofpoint tracked the actor as TA406, overlapping with the group better known as Konni or Opal Sleet.