KONNI: A Malware Under The Radar For Years
Summary: Cisco Talos documented KONNI campaigns over three years in which the actor used email attachments and social engineering to get targets to open a .scr file, which displayed a decoy document while executing the malware, with infrastructure hosted on the free provider 000webhost. The malware evolved from a single binary that generated a system ID from the registry InstallDate value and contacted a C2 at /login.php to a two-binary version adding remote administration features, keylogging and clipboard theft in a separate library, with three of four campaigns linked to North Korea.
What's compelling: Three of the four KONNI campaigns Talos examined were tied to North Korea, and the April 2017 decoy carried the names, phone numbers and email addresses of members of agencies, embassies and organizations linked to that country - a reminder that the lure itself can expose the people your organization already knows.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026