Loading story…
North Korean threat actors associated with the KONNI APT group have been observed leveraging Google's Find Hub (formerly Find My Device) to remotely wipe and track Android devices, primarily targeting South Korean individuals. The attackers initiate contact through spear-phishing campaigns, often impersonating trusted entities such as the National Tax Service or psychological counselors, and distribute malware via malicious attachments or links. Once a device is compromised, the attackers use Google Find Hub's legitimate management features to reset devices to factory settings, erasing personal data and disrupting communications, particularly by disconnecting victims from KakaoTalk sessions. This tactic not only hinders incident response and recovery but also enables the attackers to hijack messaging accounts and propagate further attacks to the victim's contacts.
Technical analysis reveals that the infection chain involves digitally signed MSI installers, BAT and VBS scripts for persistence, and the deployment of remote access trojans such as RemcosRAT, QuasarRAT, and Lilith RAT. The attackers maintain long-term access to compromised systems, conduct internal reconnaissance, and exfiltrate sensitive data. The campaign demonstrates a novel abuse of legitimate device management tools for destructive purposes and highlights the evolving sophistication of North Korean cyber operations targeting both Android and Windows platforms in South Korea.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers at Genians Security Center disclosed the campaign, attributing it to the North Korea-linked Konni cluster and documenting its use of KakaoTalk, credential theft, RAT deployment, and Google Find Hub abuse. The report included indicators of compromise and mitigation guidance for defenders.
After taking over victims' Google accounts, the attackers used Google's Find Hub/Find My Device service to locate Android devices and trigger unauthorized factory resets. The tactic erased data, destroyed evidence of compromise, and was described as the first known state-sponsored abuse of the feature for destructive wiping.
After initial compromise, the attackers harvested sensitive information such as personal data, credentials, and in some cases webcam data. They also abused victims' still-accessible KakaoTalk accounts and trusted relationships to send malware to additional contacts, expanding the intrusion.
During the campaign, victims received malicious MSI installers and other lures through spear-phishing emails and KakaoTalk messages. The malware chain deployed RATs including RemcosRAT, QuasarRAT, LilithRAT, and related tooling to establish surveillance and steal credentials.
In September 2025, the North Korea-linked Konni group launched a campaign targeting individuals in South Korea, including people connected to North Korean defectors. The operation relied on social engineering and impersonation of trusted figures such as psychological counselors, human-rights activists, and tax officials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcego.theregister.com
Open sourcedarkreading.com
Open sourcesecurityaffairs.com
Open sourcecsoonline.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple reports documented continued **KONNI** activity using spear-phishing lures tied to geopolitics, cryptocurrency, and regional news, with malware delivered through malicious Word documents, VBA macros, staged DLL payloads, and fake software components. Campaigns used North Korea-themed decoys such as CNN and Yonhap articles, later shifted to Russian-language and Huobi-themed documents, and commonly installed both 32-bit and 64-bit payloads, persisted through `rundll32.exe`, Windows Run registry keys, scheduled tasks, and downloader chains that fetched additional malware from attacker-controlled HTTP, FTP, and staged web infrastructure disguised as legitimate sites. Technical analysis showed the malware family evolving from earlier XOR-protected communications to ZIP-compressed, **RC4**-encrypted, Base64-encoded exfiltration, while retaining capabilities including reconnaissance, file theft, screenshot capture, keylogging, clipboard theft, and payload execution. Later reporting linked the KONNI ecosystem to broader North Korea-aligned operations, citing overlaps with **Kimsuky/Thallium** in infrastructure, malware formats, credentials, and delivery tradecraft, and describing newer campaigns in South Korea that used compromised KakaoTalk accounts, multiple RAT families, and stolen Google credentials to abuse Android **Find Hub** for device tracking and remote wiping of victims’ phones.
Aug 15, 2026
**Konni APT** conducted a multi-stage spear-phishing campaign that used North Korea-themed lures, including fake notices appointing targets as North Korean human rights lecturers, to deliver a malicious `LNK` file and install remote-access malware. After initial compromise, the malware remained on victim systems for an extended period, collecting internal documents, user information, and other sensitive data while maintaining covert access. The campaign stood out because the attackers moved beyond email-based intrusion and abused the victim’s already authenticated *KakaoTalk* PC session to expand the operation. After gaining unauthorized access to the victim’s *KakaoTalk* application, the threat actor selectively chose contacts from the friend list and sent them additional malicious files disguised as North Korea-related planning or video proposal documents, effectively turning trusted victims into secondary distribution nodes. Genians’ analysis described the operation as a combined pattern of long-term persistence, information theft, and account-based re-propagation, while follow-on reporting highlighted the use of social engineering tailored to the target’s interests and the value of behavior-based endpoint detection to identify the malicious `LNK`, remote-control activity, and messenger-account abuse.
Jul 8, 2026
Researchers tied a broader cyber-espionage operation to North Korea-linked actors after uncovering Android spyware variants known as **KevDroid** and a Windows backdoor dubbed **PubNubRAT** on infrastructure including `cgalim[.]com`. The Android malware stole contacts, SMS, account data, device information, screenshots, audio, video, and call recordings, and in some cases attempted rooting through `CVE-2015-3636`. Investigations also found trojanized Android apps themed around the **PyeongChang Winter Games** and **Bitcoin Ticker Widget**, while Windows infections used Korean-language lure documents exploiting `CVE-2017-11882` to download malware capable of file theft, command execution, process termination, and screenshot capture. The activity aligned with a longer-running campaign tracked as **Operation Rocket Man**, which targeted South Korean organizations, North Korea-related groups, defense entities, and individuals through spear phishing, watering-hole attacks, social-network phishing, torrent-delivered malware, malicious `HWP` and `DOC` files, Android APKs, and fake security software. Analysts linked campaigns from 2013 to 2018 through shared domains, malware code, PDB paths, metadata, and command-and-control patterns, including use of hacked Korean websites, cloud services such as **Dropbox**, **Yandex**, **pCloud**, and later **PubNub**, as well as exploits including `CVE-2018-4878` and `CVE-2017-8759`; false Chinese-language artifacts were assessed as likely deception.
Aug 15, 2026