Loading story…
Konni APT conducted a multi-stage spear-phishing campaign that used North Korea-themed lures, including fake notices appointing targets as North Korean human rights lecturers, to deliver a malicious LNK file and install remote-access malware. After initial compromise, the malware remained on victim systems for an extended period, collecting internal documents, user information, and other sensitive data while maintaining covert access. The campaign stood out because the attackers moved beyond email-based intrusion and abused the victim’s already authenticated KakaoTalk PC session to expand the operation.
After gaining unauthorized access to the victim’s KakaoTalk application, the threat actor selectively chose contacts from the friend list and sent them additional malicious files disguised as North Korea-related planning or video proposal documents, effectively turning trusted victims into secondary distribution nodes. Genians’ analysis described the operation as a combined pattern of long-term persistence, information theft, and account-based re-propagation, while follow-on reporting highlighted the use of social engineering tailored to the target’s interests and the value of behavior-based endpoint detection to identify the malicious LNK, remote-control activity, and messenger-account abuse.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Genians released public research analyzing the spear-phishing and KakaoTalk-linked threat campaign and attributed it to the Konni group, also tracing related command-and-control infrastructure to Finland, Japan, and the Netherlands.
After maintaining prolonged access and collecting documents and system information from compromised hosts, the operators abused victims' logged-in KakaoTalk PC accounts to send malicious ZIP files to selected contacts, leveraging trusted relationships for further spread.
When victims opened the LNK file, it launched PowerShell via cmd.exe, contacted command-and-control servers, downloaded additional payloads, displayed a decoy PDF, deleted the original shortcut, and created a scheduled task for persistence. The campaign deployed EndRAT and showed artifacts associated with RftRAT and RemcosRAT.
The North Korea-linked Konni group began a multi-stage spear-phishing campaign using themes related to North Korean human rights and a lecturer appointment to entice targets into opening ZIP archives containing malicious LNK files disguised as documents.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcegenians.co.kr
Open sourcegenians.co.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple reports documented continued **KONNI** activity using spear-phishing lures tied to geopolitics, cryptocurrency, and regional news, with malware delivered through malicious Word documents, VBA macros, staged DLL payloads, and fake software components. Campaigns used North Korea-themed decoys such as CNN and Yonhap articles, later shifted to Russian-language and Huobi-themed documents, and commonly installed both 32-bit and 64-bit payloads, persisted through `rundll32.exe`, Windows Run registry keys, scheduled tasks, and downloader chains that fetched additional malware from attacker-controlled HTTP, FTP, and staged web infrastructure disguised as legitimate sites. Technical analysis showed the malware family evolving from earlier XOR-protected communications to ZIP-compressed, **RC4**-encrypted, Base64-encoded exfiltration, while retaining capabilities including reconnaissance, file theft, screenshot capture, keylogging, clipboard theft, and payload execution. Later reporting linked the KONNI ecosystem to broader North Korea-aligned operations, citing overlaps with **Kimsuky/Thallium** in infrastructure, malware formats, credentials, and delivery tradecraft, and describing newer campaigns in South Korea that used compromised KakaoTalk accounts, multiple RAT families, and stolen Google credentials to abuse Android **Find Hub** for device tracking and remote wiping of victims’ phones.
Aug 15, 2026
Hackers linked to North Korea used a compromised email account belonging to a staff member of Russia’s Ministry of Foreign Affairs to spear-phish Russian diplomatic targets, including the Russian embassy in Indonesia and Deputy Foreign Minister Sergey Alexeyevich Ryabkov. The operation, tracked by Cluster25 and Lumen Black Lotus Labs and attributed to the **Konni/APT37** threat actor, used lures themed around New Year greetings and COVID-19 vaccination-status documents, along with spoofed **Mail.ru** and **Yandex** hostnames, to steal credentials and deliver **Konni RAT**. The campaign fits a longer pattern of **Konni** activity documented over multiple years. Earlier research showed the malware evolving from an information stealer into a more capable remote access trojan with persistence, file transfer, command execution, and screenshot capture, typically spread through malicious email attachments and social engineering. Analysts have also reported newer Konni variants used in campaigns targeting Russia, reinforcing that the intrusion against Russian diplomatic entities was part of a sustained espionage effort built on reused malware, tailored decoys, and recurring focus on government and embassy-linked victims.
Aug 15, 2026
North Korean threat actors associated with the KONNI APT group have been observed leveraging Google's Find Hub (formerly Find My Device) to remotely wipe and track Android devices, primarily targeting South Korean individuals. The attackers initiate contact through spear-phishing campaigns, often impersonating trusted entities such as the National Tax Service or psychological counselors, and distribute malware via malicious attachments or links. Once a device is compromised, the attackers use Google Find Hub's legitimate management features to reset devices to factory settings, erasing personal data and disrupting communications, particularly by disconnecting victims from KakaoTalk sessions. This tactic not only hinders incident response and recovery but also enables the attackers to hijack messaging accounts and propagate further attacks to the victim's contacts. Technical analysis reveals that the infection chain involves digitally signed MSI installers, BAT and VBS scripts for persistence, and the deployment of remote access trojans such as RemcosRAT, QuasarRAT, and Lilith RAT. The attackers maintain long-term access to compromised systems, conduct internal reconnaissance, and exfiltrate sensitive data. The campaign demonstrates a novel abuse of legitimate device management tools for destructive purposes and highlights the evolving sophistication of North Korean cyber operations targeting both Android and Windows platforms in South Korea.
Jun 29, 2026