Organizations and individuals tied to Ukrainian causes are now being targeted in a newly identified malware campaign that hides dangerous software inside what appear to be benign PDF documents. Instead, these are cleverly disguised Windows shortcut files (LNKs) that deploy VelvetCake, a downloader used to facilitate espionage. The operation—dubbed Operation Conflict Compass—is believed to be linked to the Konni threat actor, a group with ties to North Korea.
This effort aims to collect political and military intelligence, using ZIP email attachments that contain shortcut files posing as PDF documents. The lures cover a range of themes—proposals for Ukraine-Russia peace, rising food prices, even resumes of social researchers. When opened, these LNK files execute PowerShell commands, initiating a chain of infection while showing a decoy document to deceive the victim.
How VelvetCake Works
The campaign starts with a scheduled task installed via the shortcut, allowing repeated execution of malicious scripts through PowerShell. This ensures the infection remains persistent. VelvetCake—central to this chain—connects to a command-and-control server to fetch additional scripts and exfiltrate files, before cleaning up temporary data to cover its tracks.
Follow-on scripts glean sensitive system details: security software presence, network configuration, running processes, recent files, and available drives. A screenshot of the victim’s display is also taken and sent to remote storage. These capabilities are consistent with surveillance operations, though there’s no confirmed evidence yet of widespread data leakage among targets.
Attribution & Indicators
The attack bears hallmarks of Konni—Ukraine-focused operations, use of shortcuts, overlap in infrastructure, and similar campaign timing. While analysts rate the attribution as moderate confidence, certain clues like time-zone settings and lure themes support the assessment. No definitive list of victims has been published.
Attackers also deployed modified meeting installers with legitimate components alongside malicious ones to trick users into executing them. In some cases, alternative routes deliver the malicious payload directly from remote servers, bypassing initial installers entirely.
Indicators of compromise (IoCs) include defanged URLs pointing to GitHub repositories, domains such as medianewsonline.com, suspicious IP addresses, domains in South Korea and Ukraine, filenames like update1.vbs and update2.ps1, and a scheduled task named OneDriveUpdateScheduler. Multiple SHA-256 hashes tied to these files are also documented.
Protecting Against These Threats
Targets working in diplomacy, NGO policy, or Ukraine-related research should scrutinize unexpected attachments—especially those claiming to be PDFs—and be wary of meeting software installers. Best practices include verifying file types before opening, keeping tabs on scheduled tasks, and monitoring PowerShell behavior. Similar tactics have been used before; disguise is often just the first step in a longer infiltration.
This campaign underscores how dangerous social engineering is when paired with system-level abuse. The use of decoys, shortcuts, and staged loaders allows the attackers to maintain stealth while gathering intelligence. Vigilance at every stage of the document workflow—from email to execution—is critical to stopping campaigns like Operation Conflict Compass before they escalate.
What to watch: whether more victims emerge, what new themes are used in lures, and whether stronger attribution ties Konni definitively to this campaign. Also important will be improvements in endpoint detection around shortcut-based attacks and scheduled task monitoring to catch these subtle but potent intrusion chains.
