Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell Malware

North Korea-linked threat actors, identified as Opal Sleet, are conducting Operation Conflict Compass targeting Ukrainian diplomatic entities, think tanks, and NGOs. The campaign uses spear-phishing emails with malicious ZIP attachments containing LNK files disguised as PDFs themed around Russia-Ukraine peace plans and geopolitical issues. Execution of these LNK files downloads VBScript from GitHub, which establishes persistence via scheduled tasks and deploys VelvetCake, a PowerShell-based task runner. VelvetCake connects to command-and-control servers to download and execute scripts that perform reconnaissance, collect system information, enumerate security software, and capture screenshots. The campaign also uses trojanized Zoom installers and infrastructure in South Korea and Ukraine. Activity has been observed since early August 2026.

• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30
• Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policyCampaign2026-10-13
• BITTER Expands Its Arsenal with PapRATMalware2026-11-03
• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• TASK#STOMP PowerShell Backdoor Steals Business Documents and Maintains Persistent Remote AccessMalware2026-09-24