North Korea's Kimsuky Hackers Hid Behind GitHub and Fake Conference Invites to Spy on Ukraine's War Experts

North Korea has troops fighting for Russia, and its spies want to know how that war is going. The state hacking group Kimsuky has been targeting Ukrainian experts in diplomacy, security and international policy, according to a report published Monday by South Korean security firm Genians.

Genians thinks the goal is intelligence on the war itself. The attacks "may be aimed at collecting information on the war, the extent of North Korean troop losses, developments in the questioning and handling of prisoners of war, and the details of consultations between South Korea and Ukraine," the firm wrote. The good news: most of the attacks it observed failed.

North Korea has sent troops and other military support to Russia since 2024. In September, Ukraine transferred two captured North Korean soldiers to South Korea, and Genians said what they might reveal about operations and casualties could be of particular interest to Pyongyang.

Patient, flattering lures

The hackers took their time. On August 6, they posed as organizers of the Korea Cyber Security Conference in Seoul and invited a Ukrainian security expert to speak. They used genuine event details, praised the target's work and offered to cover travel, hotel and a fee.

The first email carried no link or attachment. Only after the target replied did a ZIP of "invitation materials" arrive. A later version was password protected, likely to slip past email scanners. Inside sat a convincing HTML invitation and a Windows shortcut dressed up as a PDF.

On August 19, the group tried another angle, posing as a European policy researcher who wanted feedback on a report about Russia and North Korea's military cooperation. After a reply, the target got a Codeberg link to a malicious archive disguised as research. When that failed, a September follow-up switched to a fake meeting login page built to steal account details. Other September lures included a peace report on Russia and Ukraine and a researcher's CV. The playbook of borrowed trust is spreading among state hackers: China-linked attackers recently impersonated Anthropic staff and former White House officials to phish AI experts.

Malware hiding in plain sight

The campaign belongs to what Genians calls Operation GitPower, and its trick is to live on developer platforms that defenders rarely block. Codeberg hosted the malicious archives, GitLab supplied decoys and scripts, and GitHub handled payload delivery and stolen data. The payloads on GitHub were disguised as ordinary repository files named LICENSE and okay.md, according to technical details of the campaign.

Clicking the fake PDF runs cmd.exe and curl to pull files from GitLab. A decoy PDF opens while a hidden script works in the background. A scheduled task disguised as a Google update then runs every 15 minutes, collecting system information and a listing of the Downloads folder and uploading it to GitHub through its API with a hardcoded access token.

The group also planted a fake, unsigned Zoom installer in a public GitHub repository. It drops hidden scripts, creates a task that runs every minute and contacts a control server. Then it launches the real Zoom installer, so the victim sees a familiar setup screen after the malware is already in place.

Genians also found Japanese-language documents on related infrastructure. They suggest the group may be preparing to target Japanese speakers, though no such attacks have been confirmed.

An old group with a new focus

Kimsuky has been active since at least 2012, going after governments, think tanks, academics and media across Asia, Europe, Japan, Russia and the US. In 2023, the US and Pacific allies sanctioned it, accusing it of gathering intelligence to support North Korea's foreign policy and sanctions evasion.

It is not the first North Korean group to turn to Ukraine. In May 2025, Proofpoint reported that TA406 was emailing Ukrainian government agencies, apparently seeking intelligence on risks to North Korean troops. Proofpoint said that focus was political and strategic, unlike Russian hackers chasing tactical battlefield information.

Genians' advice to defenders is to connect the dots rather than ban every developer platform. A shortcut that launches cmd.exe, curl or hidden PowerShell deserves a look alongside any new update-themed scheduled task and GitHub API uploads. And a real setup screen, the firm noted, does not prove an installer is safe.

Some offers on this page may be paid placements or contain affiliate links.