Loading story…
KONNI, a North Korea–aligned threat actor active since at least 2014, has been linked to an ongoing phishing campaign targeting software developers and engineering teams with access to blockchain/crypto resources across the Asia-Pacific region, including Japan, Australia, and India. The operation uses convincing project documentation (e.g., detailed requirement papers and product briefs describing trading bots, credential systems, and delivery roadmaps) to build trust with technical staff and increase the likelihood of execution.
The infection chain uses PDF-themed lures delivered alongside malicious Windows shortcut (.lnk) files (often inside ZIP archives) that trigger an embedded PowerShell loader, ultimately deploying an AI-written PowerShell backdoor. Reporting notes the backdoor is unusually “developer-like” (clean structure and extensive comments) and includes capabilities such as host reconnaissance (hardware/system details), anti-analysis checks (e.g., debugging tool detection), and single-instance execution controls—raising the risk of follow-on compromise of source code repositories, cloud consoles, signing keys, and build/CI pipelines if developer endpoints are breached.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Check Point Research publicly reported the campaign, detailing a multi-stage infection chain using a malicious LNK, PowerShell loader, CAB archive, scheduled-task persistence, and an obfuscated in-memory backdoor. The researchers assessed the malware showed signs of AI-assisted generation and published indicators of compromise for defenders.
KONNI began an ongoing phishing operation targeting software developers and engineering teams tied to blockchain and cryptocurrency projects in Japan, Australia, and India. The campaign used fake project documentation and Discord-hosted ZIP archives to compromise development environments and access sensitive assets such as credentials, wallets, and infrastructure.
Earlier samples tied to the same KONNI tradecraft were observed on VirusTotal as an older multi-script variant, indicating the campaign or its precursor tooling was already in circulation by this time.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcerescana.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple reports documented continued **KONNI** activity using spear-phishing lures tied to geopolitics, cryptocurrency, and regional news, with malware delivered through malicious Word documents, VBA macros, staged DLL payloads, and fake software components. Campaigns used North Korea-themed decoys such as CNN and Yonhap articles, later shifted to Russian-language and Huobi-themed documents, and commonly installed both 32-bit and 64-bit payloads, persisted through `rundll32.exe`, Windows Run registry keys, scheduled tasks, and downloader chains that fetched additional malware from attacker-controlled HTTP, FTP, and staged web infrastructure disguised as legitimate sites. Technical analysis showed the malware family evolving from earlier XOR-protected communications to ZIP-compressed, **RC4**-encrypted, Base64-encoded exfiltration, while retaining capabilities including reconnaissance, file theft, screenshot capture, keylogging, clipboard theft, and payload execution. Later reporting linked the KONNI ecosystem to broader North Korea-aligned operations, citing overlaps with **Kimsuky/Thallium** in infrastructure, malware formats, credentials, and delivery tradecraft, and describing newer campaigns in South Korea that used compromised KakaoTalk accounts, multiple RAT families, and stolen Google credentials to abuse Android **Find Hub** for device tracking and remote wiping of victims’ phones.
Aug 15, 2026
CISA warned that attackers were distributing **KONNI** malware through phishing emails carrying Microsoft Word documents with malicious VBA macros. The documents altered their appearance to pressure recipients into enabling content, after which the macros checked system architecture and used the Windows command shell and `CertUtil` to download, decode, and execute additional payloads. CISA described KONNI as a remote administration tool capable of file theft, keylogging, screenshot capture, arbitrary command execution, persistence, privilege escalation, and data exfiltration. The activity aligns with multiple **MITRE ATT&CK** techniques across the intrusion lifecycle, including phishing-based initial access, macro execution, discovery, command-and-control, and exfiltration. Among the mapped behaviors are host and network reconnaissance actions such as collecting local configuration details with native utilities, consistent with ATT&CK technique `T1016` for system network configuration discovery. CISA said the alert included ATT&CK mappings, Snort signatures, and mitigation guidance to help defenders detect and block the campaign.
Aug 15, 2026
Researchers linked a North Korean **Kimsuky** intrusion cluster to spearphishing campaigns that deliver ZIP archives containing malicious `.lnk` files, which launch obfuscated PowerShell, open decoy PDF documents, and create persistence through scheduled tasks. The activity, tracked by Genians as **Operation GitPower**, also used public **GitHub** and **GitLab** repositories as command-and-control channels and malware staging infrastructure, including encrypted `.NET` **AsyncRAT** payloads disguised as image files. Fortinet separately reported DPRK-linked campaigns using the same combination of LNK-based infection chains and GitHub-backed C2, reinforcing the pattern across related operations. Investigators said the operators appear to be expanding beyond conventional malware delivery and are actively experimenting with **AI-enabled tradecraft**. Artifacts showed local LLM environments built with tools including **Ollama**, **GPT4All**, and **Msty**, along with RAG-style document handling, AI agent development libraries, and **Whisper** speech-to-text components, suggesting a research-and-integration phase focused on malware development, document analysis, and attack automation rather than training original models. Attribution was supported by overlaps with prior Kimsuky techniques, Korean-language artifacts, North Korean lexical patterns, Arirang manufacturer strings, and use of **Astrill VPN**.
Aug 18, 2026