New KONNI Campaign References North Korean Missile Capabilities
Summary: Cisco Talos reported a new KONNI campaign that displays a decoy document copied from a July 3 Yonhap News Agency article on North Korean missile capabilities, while dropping two ASPack-packed KONNI binaries - both on 64-bit Windows, only the 32-bit errorevent.dll on 32-bit systems - executed via rundll32.exe with registry keys set for persistence. The command-and-control server hosts a fake climbing club website built on default CMS text, with a US address paired with a Korean-language map pointing to Seoul.
Key Takeaway: The decoy site's mismatched US address and Seoul map show the operators cut corners on infrastructure, yet Talos notes the group remains active and keeps shipping updated malware - so organizations that handle North Korea-related documents should assume the next lure will be better built than this one.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026