Reported by 3 outlets
Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell Malware
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
SOCRadar's Threat Research Unit tracks Operation Conflict Compass, a spearphishing campaign against Ukraine-focused entities attributed with moderate confidence to Konni (TA406, Opal Sleet), the North Korea-linked group, running since early August 2026 and assessed as seeking intelligence on the direction of Russia's war in Ukraine. Lures arrive as ZIP attachments holding LNK files disguised as PDFs, with themes including Russia-Ukraine peace plans and a résumé styled as the CV of a real social researcher, Olesia Tsvientukh, delivered as OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative.lnk. The target profile points at diplomatic groups, think tanks, researchers, and NGOs, though no victim list is confirmed.
Opening the shortcut pulls staged files from GitHub: a VBScript that creates a scheduled task named OneDriveUpdateScheduler launching a PowerShell payload every minute as a persistence and tasking channel, and VelvetCake, the modular PowerShell family that retrieves and runs additional scripts for collection. The September 27 addition to the record is the named CV lure, which confirms the actors mine real professional identities for decoys rather than generating generic documents.
Defenders at Ukraine-adjacent organizations should block LNK attachments at the mail gateway, alert on scheduled tasks launching PowerShell per minute under a OneDrive-sounding name, and watch GitHub repositories used as staging. Additional VelvetCake IOCs and confirmed victims are the developments that would sharpen hunting.
Timeline
-
original reporting
Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell Malware
cyberpress.org · 19d ago · September 24th, 2026
North Korea-linked hackers are targeting people and organizations focused on Ukraine with fake PDF documents that install a PowerShell malware tool called VelvetCake. SOCRadar’s Threat Research Unit named the campaign Operation Conflict Compass and assessed with moderate confidence that Konni, also tracked as TA406 and Opal Sleet, is responsible. Activity was observed from early August 2026. Researchers believe the attackers want intelligence on the direction of Russia’s war in Ukraine. Konni Targets Ukraine With VelvetCake The likely entry point is a spear-phishing email with a ZIP attachment. Inside is a Windows shortcut, or LNK file, made to look like a PDF. The document themes include Russia-Ukraine peace plans, a Ukrainian social researcher’s résumé, and the possible effect of the Strait of Hormuz situation on global food prices. Those subjects suggest the attackers may be seeking access to diplomatic groups, think tanks, researchers, and nongovernmental organizations; they do not establish a confirmed victim list. Konni Profile on SOCRadar Platform, Threat Actor Intelligence (Source: socradar) When a target opens the shortcut, it runs a command that retrieves malicious files staged on GitHub . One is a VBScript that creates a scheduled task named OneDriveUpdateScheduler . The task launches a PowerShell payload every minute, allowing the attackers to keep checking for new work. The other downloaded file is VelvetCake, the malware that retrieves and runs additional script
-
update from gbhackers.com
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
gbhackers.com · 19d ago · September 24th, 2026
North Korea-linked threat actor Konni has launched a targeted cyberespionage operation against Ukraine-focused entities using malicious Windows shortcut files disguised as PDF documents. The activity appears designed to […] The post Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from malware.news
Konni Operation Compass targets Ukraine with malicious CV .lnk lure
malware.news · 16d ago · September 27th, 2026
North Korean hacking group Konni, which has targeted individuals and organizations in Ukraine since early August 2026, is running a campaign known as Operation Compass. One of its malware lures is a file posing as the CV of Olesia Tsvientukh, a social researcher and sociologist, delivered as a .lnk shortcut. Article Link: Konni malware targeting Ukraine - CV OlesiaTsvientukh SocialResearcher Sociologist Qualitative.lnk
via Mastodon https://malware.news/t/konni-cv-olesiatsvientukh-socialresearcher-sociologist-qualitativelnk/125920#post_1