Loading story…
CISA warned that attackers were distributing KONNI malware through phishing emails carrying Microsoft Word documents with malicious VBA macros. The documents altered their appearance to pressure recipients into enabling content, after which the macros checked system architecture and used the Windows command shell and CertUtil to download, decode, and execute additional payloads. CISA described KONNI as a remote administration tool capable of file theft, keylogging, screenshot capture, arbitrary command execution, persistence, privilege escalation, and data exfiltration.
The activity aligns with multiple MITRE ATT&CK techniques across the intrusion lifecycle, including phishing-based initial access, macro execution, discovery, command-and-control, and exfiltration. Among the mapped behaviors are host and network reconnaissance actions such as collecting local configuration details with native utilities, consistent with ATT&CK technique T1016 for system network configuration discovery. CISA said the alert included ATT&CK mappings, Snort signatures, and mitigation guidance to help defenders detect and block the campaign.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
CISA published alert AA20-227A describing cyber actors using phishing emails with malicious Microsoft Word VBA macros to deploy KONNI malware, along with technical details, ATT&CK mappings, Snort signatures, and mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
us-cert.cisa.gov
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**KONNI**, a North Korea–aligned threat actor active since at least 2014, has been linked to an ongoing phishing campaign targeting **software developers and engineering teams** with access to **blockchain/crypto** resources across the **Asia-Pacific** region, including **Japan, Australia, and India**. The operation uses convincing project documentation (e.g., detailed requirement papers and product briefs describing trading bots, credential systems, and delivery roadmaps) to build trust with technical staff and increase the likelihood of execution. The infection chain uses **PDF-themed lures** delivered alongside **malicious Windows shortcut (`.lnk`) files** (often inside ZIP archives) that trigger an embedded **PowerShell loader**, ultimately deploying an **AI-written PowerShell backdoor**. Reporting notes the backdoor is unusually “developer-like” (clean structure and extensive comments) and includes capabilities such as host reconnaissance (hardware/system details), anti-analysis checks (e.g., debugging tool detection), and single-instance execution controls—raising the risk of follow-on compromise of **source code repositories, cloud consoles, signing keys, and build/CI pipelines** if developer endpoints are breached.
Jun 29, 2026
Researchers across multiple reports documented continued **KONNI** activity using spear-phishing lures tied to geopolitics, cryptocurrency, and regional news, with malware delivered through malicious Word documents, VBA macros, staged DLL payloads, and fake software components. Campaigns used North Korea-themed decoys such as CNN and Yonhap articles, later shifted to Russian-language and Huobi-themed documents, and commonly installed both 32-bit and 64-bit payloads, persisted through `rundll32.exe`, Windows Run registry keys, scheduled tasks, and downloader chains that fetched additional malware from attacker-controlled HTTP, FTP, and staged web infrastructure disguised as legitimate sites. Technical analysis showed the malware family evolving from earlier XOR-protected communications to ZIP-compressed, **RC4**-encrypted, Base64-encoded exfiltration, while retaining capabilities including reconnaissance, file theft, screenshot capture, keylogging, clipboard theft, and payload execution. Later reporting linked the KONNI ecosystem to broader North Korea-aligned operations, citing overlaps with **Kimsuky/Thallium** in infrastructure, malware formats, credentials, and delivery tradecraft, and describing newer campaigns in South Korea that used compromised KakaoTalk accounts, multiple RAT families, and stolen Google credentials to abuse Android **Find Hub** for device tracking and remote wiping of victims’ phones.
Aug 15, 2026
Researchers reported an ongoing phishing campaign dubbed **STIFF#BIZON** targeting high-value organizations in the Czech Republic, Poland, and other European countries, with activity primarily linked to North Korean threat group **APT37**. The operation delivers the **Konni RAT** through archive-based lures containing a Word document and a malicious shortcut file, giving attackers remote shell access, credential theft capability, screenshot capture, persistence, and privilege escalation on compromised Windows systems. The intrusion chain uses the shortcut file to extract a Base64-encoded PowerShell payload from the DOCX, establish command-and-control communications, and retrieve additional malware components, including a decoy document and a VBS persistence mechanism. Later stages deploy CAB archives and DLLs that replace legitimate Windows service libraries such as `wpcsvc` to run commands with elevated privileges; researchers said the tooling and tradecraft align with APT37, although some infrastructure overlaps with past **APT28/Fancy Bear** activity, leaving open the possibility of false-flagging or attribution ambiguity.
Aug 15, 2026