Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures

Operation Conflict Compass is a SOCRadar STRU-identified DPRK-aligned Konni campaign targeting Ukraine-related individuals and organizations using spear-phishing ZIPs with LNK lures and trojanized Zoom installers to deploy VelvetCake—a lightweight VBS/PowerShell task-queue runner that downloads server-side scripts, performs host reconnaissance (system/network/process enumeration, screen capture), exfiltrates data via HTTP/TCP to attacker-controlled infrastructure (including 111.92.246.145:12345 and medianewsonline subdomains), maintains persistence via a one-minute scheduled task, and leverages GitHub and free hosting for staging; the report includes detailed TTP mapping, IoCs (domains, URLs, IPs, and SHA256 hashes), and attribution evidence to Konni.