Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell Malware
Threat Actors
Excerpt
North Korea-linked hackers are targeting people and organizations focused on Ukraine with fake PDF documents that install a PowerShell malware tool called VelvetCake. SOCRadar’s Threat Research Unit named the campaign Operation Conflict Compass and assessed with moderate confidence that Konni, also tracked as TA406 and Opal Sleet, is responsible. Activity was observed from early August 2026. Researchers believe the attackers want intelligence on the direction of Russia’s war…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | p1o2i3u4y5t6r7e8w9q0.medianewsonline.com | Low | Score 33/100 | First seen |
| IP | 111.92.246.145 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…