North Korea-linked threat actors, identified as Opal Sleet, are conducting Operation Conflict Compass targeting Ukrainian diplomatic entities, think tanks, and NGOs. The campaign uses spear-phishing emails with malicious ZIP attachments containing LNK files disguised as PDFs themed around Russia-Ukraine peace plans and geopolitical issues. Execution of these LNK files downloads VBScript from GitHub, which establishes persistence via scheduled tasks and deploys VelvetCake, a PowerShell-based task runner. VelvetCake connects to command-and-control servers to download and execute scripts that perform reconnaissance, collect system information, enumerate security software, and capture screenshots. The campaign also uses trojanized Zoom installers and infrastructure in South Korea and Ukraine. Activity has been observed since early August 2026.
