A newly documented espionage campaign is using files disguised as PDFs to target people and organizations focused on Ukraine. The malicious attachments are actually Windows shortcut files that launch PowerShell, show a decoy document and install a lightweight downloader called VelvetCake. Researchers assess that the activity is designed to collect political and military intelligence related to the war.

SOCRadar named the campaign Operation Conflict Compass and linked it to Konni, a North Korea-associated threat group, with moderate confidence. Infrastructure connected to the operation appeared by August 2026. The assessment is supported by targeting themes, delivery techniques and infrastructure overlap, but it is not definitive and the researchers did not publish a confirmed victim count.

Document lures exploit topical interest

The likely delivery route is spear-phishing email carrying a ZIP archive. Inside, an LNK shortcut uses an icon and filename designed to look like a PDF. The observed subjects included a proposed Russia-Ukraine peace framework, food-price pressure linked to the Strait of Hormuz and a social researcher’s résumé.

Those themes could appeal to diplomats, policy analysts, researchers and nongovernmental organizations. When a recipient opens the shortcut, embedded commands start PowerShell, retrieve additional components and display an expected document. The decoy reduces suspicion while the infection chain continues in the background.

Researchers also found a modified video-meeting installer that bundled a legitimate application with malicious components. They could not verify how that installer reached targets, although a meeting invitation is a plausible lure. A separate executable variant loaded code directly from a remote server, reducing the malware left on disk.

VelvetCake creates a flexible surveillance channel

One downloaded script establishes persistence through a scheduled task named to resemble a routine OneDrive update. The task invokes PowerShell every minute. A second script installs VelvetCake, which contacts an operator-controlled server, downloads available instructions, executes them and uploads resulting files before cleaning temporary artifacts.

The design gives operators a reusable foothold rather than a single fixed payload. They can change collection tasks remotely without replacing the original shortcut or downloader. Frequent scheduled execution also creates repeated opportunities to reconnect after a temporary network interruption.

A recovered follow-on script surveyed installed security products, system settings, network configuration, active processes, recent files and available drives. It also captured a screenshot and sent collected material to an external server. These capabilities demonstrate that the toolchain can support surveillance and data theft, though they do not establish that every intended target was successfully compromised.

Attribution remains an assessment, not proof

Konni has a history of using document-based social engineering and shortcut files in intelligence operations. The Ukraine-centered themes, technical similarities and related infrastructure support SOCRadar’s conclusion. Earlier reporting on the broader TA406 cluster also provides context for North Korean interest in Ukrainian government and policy targets.

However, individual signals can be misleading. Reused tools may be copied, hosting can be shared and repository time-zone settings do not establish an operator’s physical location. Defenders should use the attribution to inform threat modeling while prioritizing observable behavior that can be detected regardless of who launched the campaign.

Defenders can disrupt the shortcut-to-PowerShell chain

• Inspect the true file type of documents extracted from ZIP archives, especially LNK files carrying PDF icons.
• Alert on shortcuts or installers that spawn PowerShell and then retrieve remote content.
• Hunt for newly created scheduled tasks that execute scripts at one-minute intervals.
• Review outbound traffic to unfamiliar hosting, raw code repositories and unusual high-numbered ports.
• Apply stricter controls to meeting installers received outside established software distribution channels.

Organizations supporting diplomacy, humanitarian work and policy research should assume that topical documents may be tailored to current events. Training helps, but technical controls around archive inspection, script execution and scheduled-task creation are essential because a convincing lure needs only one successful opening.

Operation Conflict Compass illustrates how a small downloader can support an adaptable intelligence operation. The initial file may resemble an ordinary briefing, but the scheduled PowerShell channel behind it gives attackers continuing access to decide what information to collect next.