Once again, North Korean threat actors are using an ongoing phishing campaign to target developers. This time, the campaign's focus is outside of the typical geographic range and shows how artificial intelligence (AI) can be used to create a new backdoor. According to a recent blog post by Check Point Research, developers with knowledge of and access to blockchain-related resources and infrastructure throughout the Asia-Pacific (APAC) region, including Japan, Australia, and India, have been the target of the advanced persistent threat (APT) group Konni.

The targeting goes "beyond the group's usual focus areas," according to the post, since Konni's previous threat campaigns mainly targeted South Korean government and politically and academically connected targets.

According to Check Point, the activity, which employs phishing lures that look like authentic project documentation, also demonstrates the group's departure from its typical strategies and objectives, suggesting a possible redirection of activity. "The targeting reflects a notable shift in behavior," the post states. Related: Attackers Take Advantage of End-of-Life Zero-Day Routers with D-Link ## The Evolution of APT Makes Defenders Wonder According to Check Point, defenders also need to be extremely aware of the evolving nature of these activities since APTs are utilizing new tools like artificial intelligence (AI) and changing tactics in campaigns that are changing rapidly.

The post stated, "This operation shows how a mature threat actor can maintain stable intrusion workflows while adapting both its targeting and tooling, especially when combined with indicators suggesting activity beyond Konni's historically South Korean-centric footprint." Regardless of how authentic the attached or embedded documents appear, anyone who receives unsolicited emails requesting them to click on them should proceed with caution. Check Point included a list of indicators of compromise (IoCs) in its blog post to assist organizations in identifying particular signs of Konni's most recent attacks on blockchain developers.

These indicators include artifacts pertaining to hashes, scripts, executables, domains, and IPs.