[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvC4glXQ4Qzsr8uga8vlNBbn5K6sezDrfSpmyufKVvpc":3},{"article":4,"iocs":33,"watch_terms":34,"solutions":35,"lesson":120},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"d961b912-f066-40b8-8943-7671ed8dabc6","North Korea Phishes Ukrainians for War Intel","north-korea-phishes-ukrainians-for-war-intel-87e484","The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.","North Korea, specifically the Democratic People's Republic of Korea (DPRK), is employing simple reply-baiting phishing attacks to gather intelligence on Ukraine's war efforts. The objective appears to be gaining insight that could potentially inform their own strategic decisions or support their allies.","North Korea is phishing Ukrainians for war intel via reply-baiting attacks.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fnorth-korea-phishes-ukrainians-war-intel","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt7314e52d65e066f0\u002F6ace87d8c13815714705c3f3\u002FUkraine_DPRK-MicroStockHub-Getty.jpg?width=720&quality=80&disable=upscale","2026-10-13T21:24:45+00:00","2026-10-13T22:00:06.333479+00:00",7,[17],{"name":18,"type":19},"DPRK","threat_actor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":20,"icon":22,"name":23,"slug":24},null,"Nation-state","nation-state",[26,28],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":36,"vendors":119},[37,65,94],{"slug":32,"name":38,"problem":39,"products":40},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[41,49,57],{"vendor_slug":42,"vendor_name":43,"vendor_logo":44,"product_slug":45,"product_name":46,"url":47,"description":48},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":66,"name":67,"problem":68,"products":69},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":95,"name":96,"problem":97,"products":98},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[99,106,112],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":100,"product_name":103,"url":104,"description":105},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":107,"product_name":108,"url":110,"description":111},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":95,"product_name":116,"url":117,"description":118},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":121,"title":122,"body":123,"framework_refs":124,"framework_notes":134},"dprk-uses-simple-phishing-to-harvest-ukraine-war-intelligence","DPRK Uses Simple Phishing to Harvest Ukraine War Intelligence","North Korea is leveraging low-sophistication reply-baiting phishing campaigns to extract sensitive intelligence about Ukraine's ongoing war efforts, demonstrating that even basic social engineering tactics remain highly effective. The root cause lies in insufficient security awareness among targeted individuals who may not recognize or question unsolicited correspondence on sensitive topics. This matters because intelligence gathered through such campaigns can directly inform adversarial military and geopolitical decisions, amplifying real-world harm far beyond a typical data breach. The simplicity of the attack vector underscores that technical defenses alone are insufficient — human vigilance is a critical last line of defense.",[125,126,127,128,129,130,131,132,133],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 9 – Email and Web Browser Protections","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-8 – Spam Protection","NIST SP 800-53 IR-6 – Incident Reporting","NIST CSF PR.AT-1 – Awareness and Training","MITRE ATT&CK T1566.003 – Phishing: Spearphishing via Service","GDPR Article 32 – Security of Processing (organizational measures)","ITIL 4 – Service Value Chain: Engage (stakeholder communication security)",{}]