In the shadows of geopolitics, KONNI has been operating quietly for more than a decade, building on its playbook of carefully staged spear-phishing campaigns and political lures targeted at South Korean institutions.
In the past, KONNI's operations followed the fault lines between diplomacy and regional security, targeting government agencies, academic institutions, non-governmental organizations, and individuals involved in inter-Korean affairs.
However, new findings from Check Point Research indicate the organization is no longer restricted to this familiar territory.
In a marked departure from its traditional approach, KONNI is currently conducting phishing campaigns targeted at blockchain developers throughout the Asia-Pacific region — including Japan, Australia, and India — signaling the company's intention of expanding geographically and recalibrating its strategic approach.
As part of the campaign, in addition to shifting attention to individuals with access to blockchain infrastructure, a novel AI-based backdoor is also introduced, illustrating a refinement of the group's technical capabilities and operational priorities.
In Check Point's analysis, the campaign appears to be the product of the North Korean threat group Konni (also tracked as Opal Sleet and TA406), which researchers believe has operational overlaps with activity clusters such as APT37 and Kimsuky.
As of at least 2014, the group has been engaged in espionage operations against South Korean entities, Russian entities, Ukrainian entities, and multiple European countries.
The telemetry generated by recent analyzed samples, however, indicates that the current wave of malware is concentrated in Asia-Pacific, with submissions originating from Japan, Australia, and India.
This confirms the assessment of a deliberate geographic pivot. Infection chains are carefully staged and multilayered, indicating that they are designed to infect in a controlled manner.
There is a Discord link provided to victims that serves a ZIP archive which contains a decoy PDF along with a malicious Windows shortcut file (LNK).
By executing the shortcut, an embedded PowerShell loader will be invoked to extract additional components, including a DOCX lure and a CAB archive. Several payload components are contained in the cabinet file, including a PowerShell-based backdoor, two batch scripts for automating User Account Control (UAC), and an executable for bypassing User Account Control.
Upon opening the shortcut, a decoy document is displayed while covertly executing a batch file embedded within, thereby ensuring the malicious activity is concealed in legitimate documentation. The lure content itself indicates that attackers intend to penetrate development environments, allowing them access to infrastructure repositories, API credentials, wallet configurations, and possibly cryptocurrency holdings.
An initial batch script establishes a staging directory for persistent storage, deposits the backdoor and secondary scripts and configures a scheduled task designed to run on an hourly basis in order to avoid detection by OneDrive.
This procedure consists of retrieving PowerShell payloads from disk, decrypting them at runtime and subsequently removing them from the system in an effort to minimize forensic visibility and complicate incident response.
A Check Point Research report further indicated that KONNI's operators have been contacting IT technicians and developers directly, using carefully constructed phishing emails that appear to be legitimate project requirements. It is the firm's belief that the objective is not limited to compromising individual systems, but is intended to gain access to cloud infrastructure, source code repositories, APIs, and blockchain credentials as well.
It has been reported that a successful compromise results in the deployment of a PowerShell backdoor that is artificial intelligence-assisted, providing persistent access to infected systems and sensitive assets within development environments. The apparent use of artificial intelligence in designing the backdoor is a distinguishing feature of the campaign.
According to Check Point, the malware's modular architecture, structured formatting, embedded developer-style comments, including placeholders indicating that AI tooling was used during development, as well as its embedded developer-style comments.
Instead of introducing fundamentally new exploitation techniques, it appears that the use of artificial intelligence simplifies the generation of code, accelerates iteration cycles, and enables rapid customization while maintaining established delivery methods.
Despite the lack of determination of the exact initial access vector, the intrusion chain unfolds through a multi-stage process that uses ZIP archives hosted by Discord's content delivery network. Each archive contains an innocent-looking PDF decoy in addition to a malicious LNK shortcut.
A shortcut is executed, launching an embedded PowerShell loader that generates an embedded Word document to serve as a distraction, as well as a CAB archive that contains the primary payload components. These include a PowerShell backdoor, two batch scripts, and an executable specifically designed for bypassing User Account Control.
Using the first batch script, the execution environment is prepared, persistence is established by way of scheduled tasks, and the backdoor is staged and launched, and it is then deleted to reduce forensic artifacts. PowerShell implants perform a number of anti-analysis and sandbox-evasion checks prior to profiling the host system and then attempt to gain access to the host system by using FodHelper UAC bypass.
A secondary batch script is executed by the malware after elevation, which removes the dropped UAC bypass binary, configures Microsoft Defender exclusions for the "C:/ProgramData" directory, and replaces the original scheduled task with an elevated task version.
A backdoor is used to maintain remote access by deploying SimpleHelp, a legitimate remote management and monitoring tool. A command-and-control server is connected via an encryption gate to filter non-browser traffic, enabling the backdoor to communicate with it continuously. This channel is used to transmit system metadata periodically and to execute PowerShell instructions provided by the server to the compromised host.
Using this layered approach, Check Point assesses that the campaign's main purpose is to establish footholds within development ecosystems, rather than targeting isolated end users. It combines malicious activity with legitimate administrative tooling to reinforce persistence. Through the use of development environments, multiple projects, services, and digital asset platforms can be leveraged downstream.
As researchers argue, the integration of AI-assisted tooling demonstrates the use of standardization and speed up of malware production while continuing to rely on proven social engineering strategies. North Korea-related operations have been observed in recent months that align with these findings.
A number of campaigns have deployed JavaScript encoded scripts disguised as Hangul Word Processor documents as a means of enabling remote access to Visual Studio Code, while others have distributed LNK files masquerading as PDF documents to deliver the MoonPeak remote access trojan following virtual environment verification.
As a result of activities associated with the Andariel subgroup in 2025, TigerRAT was used against a European law firm. An update mechanism of a South Korean ERP software vendor was compromised, allowing the distribution of multiple Trojans — StarshellRAT, JelusRAT, and GopherRAT — to downstream customers.
According to WithSecure, this ERP vendor was previously utilized in supply chain intrusions in 2017 and 2024 to propagate malware families including HotCroissant and Xctdoor.
Several of the newly identified implants demonstrate technical diversity. JelusRAT, developed in C++, is capable of retrieving plugins from command servers; StarshellRAT, created in C#, allows command execution, file transfers, screenshot capture, and GopherRAT, developed in Golang, is capable of enumerating file systems, executing commands, and exfiltrating data.
There has been a continuous display of strategic adaptability on the part of North Korea-related threat groups. Several objectives have been pursued by these groups, ranging from theft of cryptocurrency as a form of financial motivation to gathering intelligence aligned with government priorities.
Through the incorporation of artificial intelligence-assisted development techniques in conjunction with operational flexibility, a sustained evolution in tooling and targeting is evident — particularly in light of adversaries' increasing pursuit of operational areas of high value, such as software supply chains and blockchain ecosystems.
Throughout this campaign, security teams are urged to treat developer workstations, build pipelines, and repository access with the same rigor traditionally reserved for production systems as they represent one of the most strategically valuable attack surfaces in the digital economy.
Multifactor authentication is enforced on source control and cloud platforms by enforcing hardware-backed authentication, restricting local administrative privileges, monitoring schedule creation and PowerShell execution, and auditing endpoint security exclusions to ensure unauthorized changes have not occurred.
Additionally, organizations operating within blockchain-based and digital asset ecosystems should have a strict system of network segmentation, continuous credential rotation, and behavior monitoring capabilities that can detect anomalous behavior involving legitimate remote management tools.
In addition, it is necessary to strengthen defenses at the human layer of the attack given the campaign's reliance on convincingly themed project documentation and developer-centered lures.
As a result, targeted phishing simulations and secure code environment awareness training should be prioritised for engineers.
Defensers must also anticipate faster tooling cycles and increasingly modular payloads with the emergence of AI-assisted malware development.
Taking proactive measures to mitigate downstream impact will require telemetry correlation across endpoints and cloud environments, as well as rapid incident containment procedures.
Resilience will be equally dependent upon integrating security controls directly into the development lifecycle rather than treating them as a downstream safeguard as adversaries continue to recalculate their targeting of high-value technical roles and software supply chains.
.webp "Exposed Training Opens the Gap for Crypto Mining in Cloud Enviornments")
.webp)
.png "Emerging AI Built Malware Used in Targeted Attacks on Blockchain Engineers")
.png)
