North Korea-linked hackers are targeting people and organizations focused on Ukraine with fake PDF documents that install a PowerShell malware tool called VelvetCake.
SOCRadar’s Threat Research Unit named the campaign Operation Conflict Compass and assessed with moderate confidence that Konni, also tracked as TA406 and Opal Sleet, is responsible.
Activity was observed from early August 2026. Researchers believe the attackers want intelligence on the direction of Russia’s war in Ukraine.
Konni Targets Ukraine With VelvetCake
The likely entry point is a spear-phishing email with a ZIP attachment. Inside is a Windows shortcut, or LNK file, made to look like a PDF.
The document themes include Russia-Ukraine peace plans, a Ukrainian social researcher’s résumé, and the possible effect of the Strait of Hormuz situation on global food prices.
Those subjects suggest the attackers may be seeking access to diplomatic groups, think tanks, researchers, and nongovernmental organizations; they do not establish a confirmed victim list.
When a target opens the shortcut, it runs a command that retrieves malicious files staged on GitHub. One is a VBScript that creates a scheduled task named OneDriveUpdateScheduler.
The task launches a PowerShell payload every minute, allowing the attackers to keep checking for new work. The other downloaded file is VelvetCake, the malware that retrieves and runs additional scripts.
The campaign used websites in South Korea and Ukraine to host lures and a Medianewsonline subdomain for command-and-control activity.
Researchers also observed the same malicious components bundled with a trojanized Zoom installer. Its exact distribution method remains unconfirmed.
A separate variant can retrieve PowerShell code and execute it in memory rather than saving the full payload to disk. These routes give the operators more than one way to deploy the same tooling.
VelvetCake is a lightweight task runner, not a malware package with every capability built in. It contacts attacker infrastructure, downloads available PowerShell scripts, runs them, and returns the resulting files.
Because the useful functions sit in scripts supplied by the server, the operators can change their tasks without replacing the core payload on an infected computer. The one-minute scheduled task makes that on-demand design useful for repeated activity.
One recovered second-stage script collected system and network details, checked running processes and security software, listed recently opened files, and captured the screen.
It staged the results in temporary files, sent them to attacker-controlled infrastructure, and deleted local copies. This shows a clear intelligence-gathering capability, although the public findings do not establish how many systems were compromised.itnerd
SOCRadar linked the operation to Konni through its Ukraine-focused lures, familiar shortcut-and-script infection pattern, infrastructure overlaps, and operator time-zone clues.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| IP address | 111[.]92[.]246[.]145:12345 | VelvetCake command-and-control endpoint |
| Domain | p1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]com | VelvetCake C2 domain |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
