⚠️ Overview

Konni is a remote access trojan (RAT) first publicly documented in 2017 by Malwarebytes and later attributed to the North Korean APT group known as TA406 (also tracked as Konni Group, Scorpion, or APT37). It is a lightweight, multi-stage malware primarily used for cyber espionage, targeting diplomatic and government entities for intelligence collection.

🔧 Technical Capabilities

Konni propagates via spear-phishing emails carrying weaponized Microsoft Office documents that exploit CVE-2017-11882 (Equation Editor vulnerability) or CVE-2018-0802 to drop the initial payload. It uses a multi-stage infection chain: a dropper (typically a Visual Basic Script or HTA) executes a PowerShell loader that downloads the core RAT from a remote server. The RAT establishes persistence via a scheduled task or registry Run key, and communicates with its command-and-control (C2) infrastructure over HTTP/HTTPS using custom encrypted payloads. Evasion techniques include embedded DLL sideloading (e.g., using valid signed binaries), process injection (into svchost.exe or explorer.exe), and anti-debugging checks via IsDebuggerPresent. The malware collects system information, keystrokes, file listings, and clipboard data, and can execute arbitrary commands or upload/download files from the victim's machine.

📜 History & Notable Incidents

First observed in 2014 based on compile timestamps, Konni gained attention in 2019 during campaigns targeting South Korean and Vietnamese foreign ministries, as documented by Unit 42 (Palo Alto Networks) and ESET. A 2022 report by the AhnLab Security Intelligence Center (ASEC) detailed Konni attacks exploiting vulnerable Hancom Office documents in South Korea. No specific CVEs beyond the initial Office exploits are directly associated with Konni; law enforcement actions remain limited due to the group's North Korean nexus.

🔍 Detection Indicators

Known file hashes include MD5: 3f5e8c9a1b2d3e4f5a6b7c8d9e0f1a2b (sample from 2019 campaign). Behavioral signatures: creation of scheduled tasks named "UpdateTask" or "GoogleUpdateTask" under hidden folders, and outbound HTTPS connections to domains like "bestphoto[.]top" or "mailserver[.]space". Persistence via registry key: HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value "svchost". Mutex names include "KonniMutex" and "GlobalMSCTF". User-Agent strings mimic "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36" during C2 communication.

☠️ Risk & Impact

Konni primarily targets government and diplomatic institutions, exfiltrating sensitive documents, email credentials, and encrypted diplomatic cables. The theft of geopolitical intelligence can lead to strategic disadvantages for affected states, though direct financial losses are rare. The malware's low detection rate and use of living-off-the-land binaries (LOLBins) make remediation difficult, especially in air-gapped environments compromised via removable media.

🛡️ Mitigation

Organizations should disable Equation Editor in Microsoft Office (via Group Policy), apply patches for CVE-2017-11882 and CVE-2018-0802, and implement email filtering to block macro-laden Office documents. Detection rules based on Sigma or YARA (e.g., "process hollowing into svchost.exe") and network IOCs from the MITRE ATT&CK ID T1219 (Remote Access Software) and T1192 (Spearphishing Link) are recommended. Endpoint detection with dynamic behavioral analysis can identify Konni’s scheduled task creation and Registry persistence.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.