North Korea–linked KONNI uses AI to build stealthy malware tooling
Check Point links an active phishing campaign to North Korea–aligned KONNI, targeting developers with fake blockchain project docs and using an AI-written PowerShell backdoor. Check Point Research uncovered an active phishing campaign attributed to the North Korea–linked KONNI group (aka Kimsuky, Earth Imp, TA406, Thallium, Vedalia, and Velvet Chollima). The operation targets software developers and engineers using fake project […]
Check Point Research uncovered an active phishing campaign attributed to the North Korea–linked KONNI group (aka Kimsuky, Earth Imp, TA406, Thallium, Vedalia, and Velvet Chollima). The operation targets software developers and engineers using fake project documentation tied to blockchain and crypto initiatives. While consistent with KONNI’s known spear-phishing tactics, the campaign shows broader APAC targeting and features an AI-written PowerShell backdoor, highlighting evolving threat actor tradecraft.
The campaign shows expanded geographic reach beyond South Korea, with samples linked to Japan, Australia, and India. It targets engineering teams, especially those working on blockchain technologies, using lure documents disguised as legitimate project materials. These lures aim to compromise development environments and access sensitive assets such as infrastructure, credentials, wallets, and cryptocurrency. The infection chain uses a Discord-hosted ZIP containing a PDF and LNK file, which launches an obfuscated PowerShell loader.
Related breach coverage
- North Korea-linked Konni APT used Google Find Hub to erase data and spy on defectors2025-11-11
North Korea-linked APT Konni posed as counselors to steal data and wipe Android phones via Google Find Hub in Sept 2025. Genians Security Center researchers warn that the North Korea-linked Konni APT group (aka Kimsuky, Earth Imp, TA406, Thallium, Vedalia, and Velvet Chollima) posed as counselors to hack Android and Windows, stealing data and wiping phones […]
- Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics2026-04-08
APT28 targets Ukraine and allies with PRISMEX malware, using stealthy techniques for espionage and command-and-control. Russia-linked group APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) is running a spear-phishing campaign against Ukraine and its allies, deploying a new malware suite called PRISMEX. Active since September 2025, the campaign uses advanced stealth techniques like steganography and […]
- Russia-linked APT uses DRILLAPP backdoor to spy on Ukrainian targets2026-03-16
Russia-linked threat actors target Ukrainian entities with DRILLAPP backdoor and use Edge debugging for stealth. A new DRILLAPP backdoor campaign targets Ukrainian organizations, abusing Microsoft Edge debugging to evade detection. Observed in February 2026, it shows links to previous Russian-aligned operations by Laundry Bear APT group (aka UAC-0190, Void Blizzard) using the PLUGGYAPE malware family […]
- Malicious npm and PyPI packages linked to Lazarus APT fake recruiter campaign2026-02-15
Researchers found malicious npm and PyPI packages tied to a fake recruitment campaign linked to North Korea’s Lazarus Group. ReversingLabs researcher uncovered new malicious packages on npm and PyPI connected to a fake job recruitment campaign attributed to the North Korea-linked Lazarus Group. The campaign uses deceptive hiring themes to trick developers into downloading infected […]