Loading story…
Researchers disclosed NKAbuse, a newly identified multi-platform malware family that abuses the decentralized NKN peer-to-peer communication protocol to hide command-and-control traffic and provide remote access to infected systems. The malware is designed to run across multiple operating systems and uses NKN’s blockchain-based networking features to make its communications harder to trace and disrupt than traditional centralized infrastructure.
The threat gives operators broad control over compromised devices, including the ability to execute commands and manage infected hosts remotely. By embedding malicious activity inside a legitimate decentralized protocol, NKAbuse highlights how attackers are increasingly repurposing emerging networking technologies to improve resilience, evade detection, and complicate incident response efforts for defenders monitoring suspicious outbound traffic.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist disclosed NKAbuse as a newly identified multiplatform threat that abuses the NKN protocol for malicious activity. No earlier event details are provided in the reference, so the publication date is used as the timeline date.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Konni APT** conducted a multi-stage spear-phishing campaign that used North Korea-themed lures, including fake notices appointing targets as North Korean human rights lecturers, to deliver a malicious `LNK` file and install remote-access malware. After initial compromise, the malware remained on victim systems for an extended period, collecting internal documents, user information, and other sensitive data while maintaining covert access. The campaign stood out because the attackers moved beyond email-based intrusion and abused the victim’s already authenticated *KakaoTalk* PC session to expand the operation. After gaining unauthorized access to the victim’s *KakaoTalk* application, the threat actor selectively chose contacts from the friend list and sent them additional malicious files disguised as North Korea-related planning or video proposal documents, effectively turning trusted victims into secondary distribution nodes. Genians’ analysis described the operation as a combined pattern of long-term persistence, information theft, and account-based re-propagation, while follow-on reporting highlighted the use of social engineering tailored to the target’s interests and the value of behavior-based endpoint detection to identify the malicious `LNK`, remote-control activity, and messenger-account abuse.
Jul 8, 2026
Researchers from Ransom-ISAC, Bridewell, and Crystal Intelligence detailed a malware campaign that used a weaponized private GitHub repository and Telegram-based fake job lures to target developers, delivering a multi-stage infection chain built around **Cross-Chain TxDataHiding**. In the observed September 2025 intrusion, a trojanized `node-react-e-commerce` project hid encrypted JavaScript payloads and command data in blockchain transactions, using TRON or Aptos records as pointers to Binance Smart Chain data and later expanding across Ethereum, Aurora, and other chains. The malware chain included the JavaScript RAT **DEV#POPPER.js** and the Python stealer **OmniStealer**, enabling cross-platform execution on Windows, macOS, and Linux, persistence through VSCode and Cursor IDE modification, and theft of credentials, browser artifacts, wallet data, environment variables, and developer secrets. Investigators said the campaign paired blockchain-hosted payload delivery with conventional HTTP and `socket.io` command-and-control infrastructure, including clusters tied to Evoxt, Clouvider, PJSC Megafon, and a Russia-linked RDP setup, while some infrastructure also overlapped with IPs previously reported in 2025 NPM supply-chain compromises. A later financial-forensics investigation attributed the broader blockchain malware infrastructure to **North Korean threat actors** by tracing operational wallets through bridges, swap services, and laundering hubs including **Huione**, **Xinbi Guarantee**, and **BlackU**, and by linking funding flows to wallets associated with documented DPRK cryptocurrency thefts, including the **Bybit** theft. Researchers also cited weekday working-hour patterns, rotating C2 servers, and one wallet access event from IP `188.43.33.249` in Vladivostok consistent with known DPRK routing, concluding that the attackers built a hard-to-disrupt on-chain malware and C2 ecosystem designed for stealth, resilience, and cryptocurrency theft.
Aug 14, 2026
North Korea-linked threat group **Kimsuky** has been reported using malicious Windows shortcut (`.LNK`) files to initiate a **multi-stage infection chain** that ends with deployment of a **Python-based backdoor**. Reporting shared from both AhnLab and Excalibra indicates the campaign relies on weaponized LNK files as the initial access vector, with the malware delivery process evolving from earlier distribution patterns. The activity was attributed to Kimsuky in threat-intelligence reporting and social media amplification, with references also linking the cluster to **DPRK** operations and possible overlap or comparison with **Konni** tracking. While the cited summaries did not include victimology or technical indicators, they consistently described a shift in how the group distributes malware and highlighted the use of LNK-based social engineering to stage follow-on payloads.
Jun 30, 2026