Kim Jong-Un sent roughly 14 000 to 15 000 troops to fight alongside Russia in October 2024, and Proofpoint suspects Moscow never gave Pyongyang a timetable for getting them home. So North Korea appears to have gone to the other side of the front for answers. Hackers linked to the DPRK have been spear-phishing Ukrainian government officials, academics, and policy experts, and Genians Security Center assesses the campaign went looking for casualty numbers, how prisoners are being handled, and what happened to the two North Korean POWs Ukraine transferred to South Korea in September.
Those targets don’t open attachments from strangers, so the first email doesn’t carry one. No link either — just a credible greeting built to earn a reply and slip past email filters. One attack began on August 6, 2026, with an email impersonating the organizers of a Seoul security conference. Answer it, and the follow-up arrives: a malicious LNK file wearing a PDF icon and a double extension.
Patience is the whole technique, and it only half works. Recent attempts have been littered with errors, including emails inviting victims to Google Meet calls that contain Zoom links instead, and Genians says most of the observed attempts failed. Proofpoint’s Greg Lesnewich says the group takes little effort to hunt — the pace and volume are what wear defenders down.
Source: Dark Reading
