Loading story…
Hackers linked to North Korea used a compromised email account belonging to a staff member of Russia’s Ministry of Foreign Affairs to spear-phish Russian diplomatic targets, including the Russian embassy in Indonesia and Deputy Foreign Minister Sergey Alexeyevich Ryabkov. The operation, tracked by Cluster25 and Lumen Black Lotus Labs and attributed to the Konni/APT37 threat actor, used lures themed around New Year greetings and COVID-19 vaccination-status documents, along with spoofed Mail.ru and Yandex hostnames, to steal credentials and deliver Konni RAT.
The campaign fits a longer pattern of Konni activity documented over multiple years. Earlier research showed the malware evolving from an information stealer into a more capable remote access trojan with persistence, file transfer, command execution, and screenshot capture, typically spread through malicious email attachments and social engineering. Analysts have also reported newer Konni variants used in campaigns targeting Russia, reinforcing that the intrusion against Russian diplomatic entities was part of a sustained espionage effort built on reused malware, tailored decoys, and recurring focus on government and embassy-linked victims.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Cluster25 published research in late December 2021 describing a phishing campaign targeting individuals in the Russian diplomatic apparatus and delivering Konni RAT. The report linked the activity to the Konni/APT37 threat actor.
In late December 2021, attackers used the compromised Russian Ministry of Foreign Affairs account mskhlystova@mid[.]ru to send phishing emails carrying a holiday-themed ZIP archive. Targets included staff at the Russian embassy in Indonesia and Deputy Foreign Minister Sergey Ryabkov, and the infection chain delivered Konni RAT disguised as scrnsvc.dll.
Around November 7, 2021, the attackers launched another campaign delivering links to an archive containing documents requesting vaccination-status information. The archive included an executable masquerading as legitimate COVID-19 vaccination-checking software that installed Konni.
A spear-phishing campaign against Russian diplomatic entities was active since at least October 19, 2021. Black Lotus Labs said the activity sought to harvest credentials for an active Russian Ministry of Foreign Affairs account.
Malwarebytes published research on a new KONNI malware variant used in a campaign targeting Russia. Black Lotus Labs later said a first-stage agent in the 2021 activity was nearly identical to one Malwarebytes had previously identified.
Cisco Talos analyzed four KONNI malware campaigns conducted in 2014, 2016, and twice in 2017, describing the malware’s evolution from an information stealer into a more capable RAT. The campaigns used malicious email attachments, decoy documents, and infrastructure hosted on free web hosting services.
Black Lotus Labs independently tracked related spear-phishing campaigns, confirmed Cluster25’s infection-chain findings, and identified reuse of IP address 152.89.247[.]26 across the October and December activity. It attributed the campaigns against Russian diplomatic entities to the North Korean Konni/APT37 threat actor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
blog.lumen.com
Open sourcebleepingcomputer.com
Open sourceblog.talosintelligence.com
Open sourceblog.malwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple reports documented continued **KONNI** activity using spear-phishing lures tied to geopolitics, cryptocurrency, and regional news, with malware delivered through malicious Word documents, VBA macros, staged DLL payloads, and fake software components. Campaigns used North Korea-themed decoys such as CNN and Yonhap articles, later shifted to Russian-language and Huobi-themed documents, and commonly installed both 32-bit and 64-bit payloads, persisted through `rundll32.exe`, Windows Run registry keys, scheduled tasks, and downloader chains that fetched additional malware from attacker-controlled HTTP, FTP, and staged web infrastructure disguised as legitimate sites. Technical analysis showed the malware family evolving from earlier XOR-protected communications to ZIP-compressed, **RC4**-encrypted, Base64-encoded exfiltration, while retaining capabilities including reconnaissance, file theft, screenshot capture, keylogging, clipboard theft, and payload execution. Later reporting linked the KONNI ecosystem to broader North Korea-aligned operations, citing overlaps with **Kimsuky/Thallium** in infrastructure, malware formats, credentials, and delivery tradecraft, and describing newer campaigns in South Korea that used compromised KakaoTalk accounts, multiple RAT families, and stolen Google credentials to abuse Android **Find Hub** for device tracking and remote wiping of victims’ phones.
Aug 15, 2026
**Konni APT** conducted a multi-stage spear-phishing campaign that used North Korea-themed lures, including fake notices appointing targets as North Korean human rights lecturers, to deliver a malicious `LNK` file and install remote-access malware. After initial compromise, the malware remained on victim systems for an extended period, collecting internal documents, user information, and other sensitive data while maintaining covert access. The campaign stood out because the attackers moved beyond email-based intrusion and abused the victim’s already authenticated *KakaoTalk* PC session to expand the operation. After gaining unauthorized access to the victim’s *KakaoTalk* application, the threat actor selectively chose contacts from the friend list and sent them additional malicious files disguised as North Korea-related planning or video proposal documents, effectively turning trusted victims into secondary distribution nodes. Genians’ analysis described the operation as a combined pattern of long-term persistence, information theft, and account-based re-propagation, while follow-on reporting highlighted the use of social engineering tailored to the target’s interests and the value of behavior-based endpoint detection to identify the malicious `LNK`, remote-control activity, and messenger-account abuse.
Jul 8, 2026
North Korea-linked threat actors compromised **NPO Mashinostroyeniya**, a sanctioned Russian missile engineering and defense-industrial company, in an apparent cyberespionage operation tied to Pyongyang’s missile-development interests. SentinelLABS said the intrusion involved two separate but overlapping campaigns: a Linux email server compromise attributed to **ScarCruft** and a Windows intrusion using the Lazarus-linked **OpenCarrot** backdoor. The victim reportedly detected suspicious outbound traffic and a malicious DLL in mid-May 2022, but the full extent of the breach was not initially understood. Researchers said **OpenCarrot** enabled broad reconnaissance, process and filesystem manipulation, proxying, and multi-channel command-and-control, suggesting the attackers may have achieved wider network access. Infrastructure tied to the operation included domains such as `centos-packages[.]com` and `redhat-packages[.]com`, while later infrastructure reuse linked the activity to ScarCruft campaigns associated with **RokRAT**-style tradecraft. SentinelLABS assessed with high confidence that North Korea-affiliated operators were responsible, although it remains unclear whether **Lazarus** and **ScarCruft** shared access or were independently tasked against the same Russian target.
Jul 12, 2026