This campaign by North Korea-linked threat actors involves spear-phishing emails with malicious ZIP attachments containing LNK files masquerading as PDFs themed around Russia-Ukraine peace plans and geopolitical topics. When executed, these LNK files retrieve malicious VBScript from GitHub, which establishes persistence through scheduled tasks and deploys VelvetCake, a PowerShell-based task runner. VelvetCake connects to command-and-control infrastructure to download and run additional scripts that conduct reconnaissance, gather system information, enumerate security software, and capture screenshots. The campaign also employs trojanized Zoom installers and leverages infrastructure located in South Korea and Ukraine. The threat actor group, identified as Opal Sleet, has been active since early August 2026, focusing on Ukrainian diplomatic and research targets.

The campaign enables threat actors to maintain persistence on compromised systems, perform detailed reconnaissance, collect sensitive system and security information, and capture screenshots, potentially exposing confidential data. The use of spear-phishing and trojanized legitimate software installers increases the risk of successful compromise of targeted organizations. The targeting of diplomatic entities, think tanks, and NGOs in Ukraine suggests potential espionage and intelligence-gathering objectives.

No official patch or remediation is indicated for this campaign. Organizations should be aware of spear-phishing attempts using LNK files disguised as PDFs and malicious ZIP attachments themed around geopolitical topics. Users should avoid opening unexpected attachments and verify the authenticity of software installers such as Zoom. Monitoring for scheduled tasks created without authorization and unusual PowerShell activity may help detect infections. Since this is an active campaign, applying email filtering and user awareness training focused on spear-phishing is recommended.