North Korean state-sponsord hackers are spear-phishing government, policy, and academic circles in Ukraine to pilfer intelligence about the country's own position in theRussia-Ukraine war. The Democratic People's Republic of Korea (DPRK) joined the Russian war effort in Ukraine in October 2024. It supported its ally most notably by sending around14,000 to 15,000troops to the front lines. It didn't all go to plan, though. For example, Ukrainetransferredtwo North Korean prisoners of war to South Korea. To keep apprised of all that's happening 4,000 miles away, North Korean threat actors have been targeting Ukrainian organizations and individuals with phishing attacks to gather intelligence. According to South Korea-based Genians Security Center, thisespionage campaignhas been going on for some years now. And like the rest of the DPRK's war effort, though, it appears to be a bit clumsy. For a couple of years now, different research groups have been picking up on evidence of North Korean hackers targeting Ukraine. First,Proofpoint researchers revealedthat hackers associated with the North Korean government had been lobbing spear-phishing attacks at Ukrainian government agencies. The activity dated back at least to February 2025, only a few months after Kim Jong-Un's war aid began. Proofpoint tracked the actor asTA406, overlapping with the group better known as Konni or Opal Sleet. In August 2026, the Digital Security Lab Ukraine (DSLU), a non-governmental organization (NGO), investigated aspear-phishing attackagainst a Ukrainian civil service member. It didn't attribute a particular threat actor, but made special note that "this is not an isolated incident." And last month, at the Korea Cyber Security Conference (KSCON) 2026 in Seoul, a researcher from local firm Enki White Hat described tactics, techniques, and procedures (TTPs) he associated with North Korea'sadvanced persistent threat(APT) "Kimsuky." The presentation focused on continuing attacks against South Korean targets in particular. In a blog post published on Sunday, Genians merged all of these separate findings into a single, cohesive picture — aKimsuky campaigndesigned to target war intelligence out of Ukraine. More specifically, the researchers wrote that Kimsuky is gathering information about "the war situation, the extent of North Korean military casualties, trends in prisoner investigation and handling," and, in particular, details surrounding the situation of those two soldiers sent from Ukraine to South Korea. Ironically, "Before they shifted to targeting Ukraine, they were really interested in Russian experts in the West," Greg Lesnewich, principal threat research engineer at Proofpoint notes. "They would target Russia-related experts to try to understand potentially what Russia is thinking." Lesnewich says the shift could be an indication that DPRK officials aren't getting the straight story from the Russian government. "My suspicion about that is that Russia wouldn't tell them how long their troops were going to be in Ukraine, because they didn't have a timetable. So they went to target entities in Ukraine, to see if there was some estimate they could get for how long Ukraine might hold out," he speculates. It may all sound rather grand but, in practice, the attacks themselves are rudimentary. The best tactic the threat actor has going for it might be reply-baiting. Instead of sending transparent phishing emails with malware attached, it sends relatively inoffensive initial greetings meant to build a rapport with the target, and sneak through email security barriers. For instance, the researchers identified a spear-phishing attack aimed at Ukrainian foreign affairs and security experts, in which the attackers impersonated the organizing committee of KSCON 2026. The emails included real event details and references to the recipient's area of expertise, and offered compensation for flights and accommodations, plus a presentation fee, if the recipient would only visit to be a guest speaker. If victims replied to this attractive offer they then were served their official "invitation": a malicious shortcut (LNK) file, masked as a PDF via a PDF icon and double extension (".pdf.lnk"). Besides reply-baiting, the activity Genians attributes to Kimsuky involves some very basiccommand obfuscation, scheduled tasks for persistence, and scripts, documents, and commands hosted via public repository services like GitHub and GitLab. Like other lazy hackers, the group has been experimenting with large language models (LLMs), the researchers wrote. Its recent attacks have also been peppered with pretty obvious errors, like emails inviting victims to Google Meet calls that actually contain Zoom links. "They aren't innovators in this space. They are a middle-of-the-road kind of actor," Lesnewich says. "We saw a couple of times where they were observing some other threat actor — potentially from public blogging — using a certain infection chain, and then they would borrow from that and use it against their targets." Luckily for organizations, these less inspiring North Korean threat actors can be spotted pretty easily. "We don't have to do a lot to hunt for them. It's just the pace and the volume can really wear you down," he acknowledges. Lesnewich tells Dark Reading that the threat actor it tracks as TA406 seems less active in 2026 than 2025, having been particularly quiet during the summer, though that may be because it's evolving. Some newer, lesser defined groups "almost feel like pieces of TA406, going off in different directions," he says. For instance, Proofpoint associates the GitHub-related attack chain described in Genians' new blog with an as yet unnamed threat actor. "One of these subclusters that we're seeing we call "Honeycrisp," he continues, noting that the designation is only temporary. With Honeycrisp, "We're actually seeing a good amount of targeting of education, and, particularly, either spoofing or targeting former diplomats who have landed in places like higher education or think tanks. So we're kind of seeing two clusters: TA406, doing the same things Genians saw. And then we have another that is doing stuff that's also similar, but with vastly different targeting." Without commenting on Genians' attribution specifically, Lesnewich argues that cybersecurity analysts in general have been somewhat imprecise in grouping possibly distinct North Korean actors into general buckets. "We'll make the distinction for Russian APTs — that a Sandworm-related actor handed off access to anAPT28-related actor. But for some reason, withNorth Korea, it's all just thrown into 'If it's kind of good [TTPs] it's Lazarus, and if it's kind of bad, it's Kimsuky,'" he laments. "My working theory," Lesnewich says, "is that the reorganization from the Reconnaissance General Bureau (RGB) [DPRK's intelligence agency] in early 2026, plus North Korea's regular shuffling of operators and people — at least as best we can kind of tell, since this is from the outside looking in — [caused] a shake-up of the historic kinds of lines being drawn, where 'this' is what designates one actor and 'this' is what designates another one."