Executive Summary
The SOCRadar Threat Research Unit (STRU) has identified a targeted cyberespionage campaign dubbed Operation Conflict Compass, attributed to the North Korean threat actor Konni (a subgroup of Kimsuky). Active as recently as August 2026, the campaign specifically targets individuals and organizations involved in Ukrainian foreign policy and defense, likely to gather intelligence on the trajectory of the Russian invasion and its geopolitical consequences.
The attack chain typically begins with spear-phishing emails containing malicious ZIP archives. These archives house LNK files masquerading as PDF documents focused on global food prices and peace negotiation frameworks. Execution leads to the installation of VelvetCake, a minimalist PowerShell downloader that functions as a near-real-time task runner by retrieving server-side modules from remote infrastructure.
This campaign underscores Konni's adaptability, using legitimate services like GitHub for script staging and South Korean/Ukrainian web hosting for lures. The modular nature of VelvetCake allows the adversary to perform system reconnaissance, screen capture, and data exfiltration while maintaining a low footprint on the infected host.
Key Details
Threat Name
Operation Conflict Compass
Affects
RARLAB WinRAR, Windows SmartScreen
Adversary
Konni Other Adversaries and Aliases: Kimsuky
MITRE Techniques
Malware/Tools
VelvetCake, KONNI, EndRAT, CARROTBAT, FlowerPower, GitPower, BabyShark