Konni Campaign Uses Spear-Phishing, RATs and KakaoTalk to Spread Malware
Summary
Genians analyzes a Konni campaign that used spear-phishing and malicious LNK files to install RATs, steal information, persist on victims’ systems, and spread additional malware through compromised KakaoTalk sessions.
Key points
- Spear-phishing emails posing as notices about North Korean human rights lectures led recipients to malicious LNK files.
- The LNK files used PowerShell to decode a decoy PDF, download payloads, and establish scheduled-task persistence.
- The analysis identified EndRAT, RftRAT, and RemcosRAT, with capabilities including remote shell access, file transfer, and system control.
- Attackers reportedly abused victims’ KakaoTalk PC sessions to send malicious files to selected contacts.
- The report links the campaign to Konni based on similarities in tactics, malware, and infrastructure, including a connection to earlier activity.
- Genians recommends behavior-based EDR monitoring for suspicious process activity, persistence, data collection, C2 traffic, and abnormal messenger file transfers.
Article Details
- Attack Vectors
- Spear-phishing emails impersonated notices appointing recipients as North Korean human rights lecturers and induced them to open archives containing malicious LNK files.
- Document-disguised LNK files launched cmd.exe and PowerShell, displayed an embedded decoy PDF, downloaded follow-on payloads, and established scheduled-task persistence.
- The attacker abused compromised KakaoTalk PC sessions to send malicious archives to selected contacts, using North Korea-related video-content proposals as lures.
- AutoIt-based payloads provided remote command execution, file browsing, bidirectional file transfer, and persistent access through scheduled tasks and Startup-folder shortcuts.
- Defensive Notes
- Inspect or quarantine archives containing LNK files, scripts, and executables; restrict receipt where business requirements permit.
- Train users to recognize document-icon shortcuts, impersonated official notices, and malicious attachments sent through trusted contacts.
- Correlate LNK execution, cmd.exe and PowerShell activity, payload downloads, scheduled-task creation, Startup registration, memory-loaded malicious modules, and external communications using EDR.
- Investigate access to drfeysal[.]com, AutoIt3.exe and APDNHFU.pdf under C:\Users\Public\Videos, and the APDNHFU scheduled task.
- Monitor sensitive-document access, abnormal file collection, potential bulk exfiltration, and information access outside normal business hours; use forensic investigation and threat hunting to identify delayed follow-on activity.
- Monitor messenger file transfers for unusual volume, repetition, and deviations from normal behavior, and review session protection, authentication, stored credentials, and session artifacts.
- Isolate suspected compromised endpoints, preserve malicious-file evidence, review process trees and persistence mechanisms, and investigate messenger-based secondary distribution.
- The publisher states that Genian Insights E supports behavior-based detection, attack-flow visualization, endpoint isolation, evidence collection, and investigation of associated process and network activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | drfeysal[.]com | C2 and payload-delivery domain used by the malicious LNK's PowerShell script to download AutoIt3.exe and APDNHFU.pdf. |
| IPV4 | 157[.]180[.]88[.]26 | C2 address hardcoded in the mmlib.au3 EndRAT variant, using port 443; the article associates it with Finland. |
| IPV4 | 178[.]16[.]54[.]208 | Netherlands-associated C2 address for the RemcosRAT payload concealed in sqlite4.au3. |
| IPV4 | 185[.]21[.]14[.]249 | Hardcoded EndRAT C2 address contacted through a custom TCP protocol on port 80. |
| IPV4 | 96[.]62[.]214[.]5 | Japan-based C2 address associated with cliconfg.au3 and RftRAT; researchers identify it as a correlation point with earlier Konni infrastructure. |
| MD5 | 01022facb38cf60b052e65a682f4a127 | MD5 malware-artifact indicator listed in the report; its specific file association is not disclosed. |
| MD5 | 148405ff05bf15a6a053e4e7c1795d40 | MD5 malware-artifact indicator listed in the report; its specific file association is not disclosed. |
| MD5 | 2e1b0ac49313873a0e0b982c591a5264 | MD5 malware-artifact indicator listed in the report; its specific file association is not disclosed. |
| MD5 | 3288c284561055044c489567fd630ac2 | MD5 malware-artifact indicator listed in the report; its specific file association is not disclosed. |
| MD5 | 461ade40b800ae80a40985594e1ac236 | MD5 malware-artifact indicator listed in the report; its specific file association is not disclosed. |
| MD5 | 61f65bd593ea0e52ac0dfdc6bc9cd73a | MD5 malware-artifact indicator listed in the report; its specific file association is not disclosed. |
| MD5 | 7dc50e8af0070e544bff5299405cd3b9 | MD5 malware-artifact indicator listed in the report; its specific file association is not disclosed. |
MITRE ATT&CK
T1005 · Data from Local SystemThe attacker collected internal documents and sensitive information from infected endpoints.T1027 · Obfuscated Files or InformationThe samples concealed data through XOR encoding, repeated-key subtraction, compiled AutoIt containers, and RC4-encrypted RemcosRAT configuration.T1027.001 · Binary PaddingAPDNHFU.pdf included random ASCII padding before and after its AutoIt container; EndRAT also added random garbage around script data.T1036 · MasqueradingMalicious shortcuts used document icons, APDNHFU.pdf concealed an AutoIt container, and additional malicious files masqueraded as legitimate programs or system components.T1041 · Exfiltration Over C2 ChannelEndRAT read requested local files below its 30 MB transfer limit and sent their binary contents through its C2 connection.T1053.005 · Scheduled TaskThe dropper created the APDNHFU task to execute AutoIt3.exe with APDNHFU.pdf every minute; EndRAT also registered tasks at randomized five-to-ten-minute intervals.T1059.001 · PowerShellThe LNK launched 32-bit PowerShell to decode a decoy, download payloads, delete the shortcut, and create persistence.T1059.003 · Windows Command ShellThe LNK invoked cmd.exe /c, and EndRAT used command-shell execution and BAT files to perform commands and register scheduled tasks.T1070.004 · File DeletionThe PowerShell script deleted the original malicious LNK with remove-item -force after opening the decoy document.T1082 · System Information DiscoveryEndRAT collected compromised-system information and transmitted it as JSON during initial C2 registration.T1083 · File and Directory DiscoveryEndRAT enumerated drives and scanned directories to return file and directory listings to its C2 server.T1095 · Non-Application Layer ProtocolEndRAT used a custom TCP socket protocol with string delimiters on port 80 rather than HTTP requests.T1105 · Ingress Tool TransferThe dropper downloaded AutoIt3.exe and APDNHFU.pdf from external infrastructure, and EndRAT supported receiving additional files.T1140 · Deobfuscate/Decode Files or InformationThe PowerShell dropper decoded the embedded PDF with XOR key 0x3D, while RftRAT decoded its C2 address using repeated subtraction operations.T1204.002 · Malicious FileRecipients executed document-disguised LNK files, triggering the malware installation chain.T1547.001 · Registry Run Keys / Startup FolderStart_Web.lnk and SVC_Init.lnk in the Windows Startup folder launched malicious AutoIt payloads when the user logged on.T1566.001 · Spearphishing AttachmentInitial spear-phishing emails used lecturer-appointment notices to persuade recipients to open archives containing malicious LNK files.T1566.003 · Spearphishing via ServiceThe attacker sent malicious files through compromised KakaoTalk sessions to selected contacts using North Korea-related content proposals.
Threat Actors
Malware
EndRATAnalysis of the source code obtained through decompilation showed that the file matches the operational structure of the EndRAT malware family that has been publicly reported.Remcos RATAnalysis of the three identified AutoIt scripts revealed different RAT families, including EndRAT, RftRAT, and RemcosRAT.RftRATAnalysis of the three identified AutoIt scripts revealed different RAT families, including EndRAT, RftRAT, and RemcosRAT.
Vendors
Products
AutoItExecutes the AutoIt script downloaded from the C2 server and performs additional malicious commandsGenian Insights EIntegrated Security Strategy Based on "Genian Insights E"KakaoTalkAfter gaining unauthorized access to the victim’s KakaoTalk PC application, the threat actor selectively chose contacts from the friend list for secondary distribution of the malicious file.Microsoft WindowsThe LNK target is set to "cmd.exe", and its arguments include the "/c" option together with the 32-bit PowerShell path, "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe".PowerShellLaunches 32-bit PowerShell (SysWOW64) through "cmd.exe"
Countries
FinlandThe C2 infrastructure is assessed to use addresses distributed across multiple countries, including Finland, Japan, and the Netherlands.JapanThe C2 infrastructure is assessed to use addresses distributed across multiple countries, including Finland, Japan, and the Netherlands.NetherlandsThe C2 infrastructure is assessed to use addresses distributed across multiple countries, including Finland, Japan, and the Netherlands.