North Korea, which started deploying troops to assist Russian forces in Ukraine in late 2024, is likely using this intelligence to assess risks to its own forces on the ground and to gauge whether Moscow will require further military support, researchers said. TA406, also tracked under the names Opal Sleet and Konni, has used a variety of techniques in its recent campaigns in Ukraine, including impersonating think tank members to trick victims into opening phishing emails related to recent events in Ukrainian domestic politics. North Korean state-backed hackers have targeted Ukrainian government entities in a new espionage campaign, likely aimed at gathering intelligence on Russia’s war efforts, researchers have found. The latest wave of activity in Ukraine suggests that Pyongyang is seeking to “better understand the appetite to continue fighting against the Russian invasion” and “the medium-term outlook of the conflict,” according to the latest report by cybersecurity firm Proofpoint. The group, tracked as TA406, is known for using spear-phishing attacks to target governments, research centers, think tanks, academic institutions and media organizations worldwide — particularly in Europe, Japan, Russia, South Korea and the United States. Earlier in February, the European Union sanctioned the head of North Korea’s Reconnaissance General Bureau (RGB), Lee Chang Ho, who was allegedly involved in deploying North Korean personnel to support Russia’s war against Ukraine. Ukrainian researchers rarely speak of North Korean cyberattacks on their systems — most espionage campaigns against the country are attributed to Russian hackers. If decrypted and executed, the archive would initiate a chain of infections using PowerShell, allowing the attackers to collect data on the target computer, including IP configuration, file names, disk information and installed antivirus software. According to Proofpoint, TA406’s cyber efforts in Ukraine are focused on political intelligence and strategic analysis of the ongoing war. As of the time of writing, Ukraine’s computer emergency response team (CERT-UA) has not responded to a request for comment from Recorded Future News regarding TA406’s latest campaign.
This Cyber News was published on therecord.media. Publication date: Tue, 13 May 2025 11:54:58 +0000