Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

New KONNI Malware attacking Eurasia and Southeast Asia

Summary: Unit 42 observed two waves of attacks from early 2018 through at least July 2018 using a new malware family it named NOKKI, which shares code and infrastructure with KONNI and likely targets politically-motivated victims in Eurasia and possibly Southeast Asia. The attacks used compromised legitimate servers, largely in South Korea, for delivery and command and control, with decoy documents created by an author named 'zeus' and content in Cambodian and Russian political themes.

Bottom line: The operators ran two distinct variants over roughly seven months, shifting from FTP to HTTP command and control while reusing the same compromised South Korean university, research institute, and engineering organization servers - infrastructure that belonged to legitimate institutions, not the attackers.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related