A new cyber threat campaign has been identified in South Korea in which attackers pretended to represent human rights groups and financial institutions to trick people into opening harmful files. The findings were published on January 19 by United Press International, citing research from South Korean cybersecurity firm Genians.
According to Genians, the attackers sent deceptive emails that appeared to come from legitimate North Korea-focused human rights organizations and South Korean financial entities. These messages were designed to persuade recipients to click links or open attachments that secretly installed malware on their devices. Malware refers to harmful software that can spy on users, steal information, or allow attackers to control infected systems.
The campaign has been named “Operation Poseidon” by researchers and has been linked to a hacking cluster known as Konni. Security analysts have associated Konni with long-running advanced persistent threat operations. Advanced persistent threats, often called APTs, are prolonged cyber operations that focus on maintaining covert access rather than causing immediate disruption. Genians reported that Konni shares technical infrastructure and target profiles with other North Korea-linked groups, including Kimsuky and APT37. These groups have previously been connected to cyber espionage, surveillance, and influence efforts directed at South Korean government bodies, researchers, and civil society organizations.
The emails used in this operation did not contain direct malicious links. Instead, the attackers hid harmful destinations behind legitimate online advertising and click-tracking services that are commonly used by businesses to measure user engagement. By routing victims through trusted services, the links were more likely to pass email security filters. Genians found that the redirections relied on Google Ads URLs and poorly secured WordPress websites. The final destinations hosted malware files that were often disguised as ordinary PDF documents or financial notices, increasing the likelihood that users would open them.
Security professionals note that campaigns of this nature are difficult to defend against because they combine technical methods with psychological manipulation. Genians assessed that the characteristics of Operation Poseidon reflect a high level of planning and sophistication, making it hard for any single security tool to stop such attacks on its own.
The findings come amid growing international concern over North Korea’s cyber operations. In October, the 11-country Multilateral Sanctions Monitoring Team described North Korea’s cyber program as a state-level effort with capabilities approaching those of China and Russia. The group reported that nearly all malicious cyber activity linked to the Democratic People’s Republic of Korea is conducted under the direction of entities sanctioned by the United Nations for involvement in weapons programs. In November, the United States Treasury Department estimated that more than 3 billion dollars had been stolen over the past three years through attacks on financial systems and cryptocurrency platforms.
Genians advised individuals and organizations to treat unsolicited emails with caution. The firm warned that attackers are likely to continue impersonating financial institutions and urged users not to trust documents based only on subject lines or file names.
