“Security alert”-themed spear-phishing of 28 individuals including 11 officials from six Security Council members

CSIS Significant Cyber Incidents

A North Korean hacking group targeted 28 UN officials in a spear-phishing campaign, including at least 11 individuals representing six members of the UN Security Council.

ThaiCERT Threat Group Cards

North Korea has tried to hack 11 officials of the UN Security Council https://www.zdnet.com/article/north-korea-has-tried-to-hack-11-officials-of-the-un-security-council/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

A hacker group previously associated with the North Korean regime has been spotted launching spear-phishing attacks to compromise officials part of the United Nations Security Council. The attacks have taken place this year and have targeted at least 28 UN officials, including at least 11 individuals representing six countries of the UN Security Council.

CFR Cyber Operations Tracker

North Korean hackers launched a spear-phishing campaign that disguised malware as UN security alerts and interview requests. At least twenty-eight UN officials, eleven of whom represented six members of the UN Security Council, were targeted.

Wikipedia (English), accessed 2026-10-06

In September 2020 it was reported that Kimsuky attempted to hack 11 officials of the United Nations Security Council.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Kimsuky, a hacker group previously associated with the North Korean regime has been spotted launching spear-phishing attacks to compromise officials part of the United Nations Security Council.

UN Panel of Experts S/2020/840

Para 118: “According to information from another Member State, at least 28 individuals, including at least 11 officials from six members of the Security Council, became the targets of a spear-phishing campaign in 2020 which appeared to have been conducted by a Kimsuky advanced persistent threat group. According to the information, these Democratic People’s Republic of Korea cyberactors launched a “security alert”-themed spear-phishing campaign in mid-March against Gmail accounts of the targeted individuals ...”

The campaign was attributed to an advanced persistent threat group (APT) known as Kimsuky

the DPRK-linked cybercrime group “Kimsuky” targeted at least 11 officials from six Security Council member countries