Konni APT, a threat group, has been caught running a multi-stage attack campaign that starts with targeted spear-phishing emails and ends with taking over victims' KakaoTalk messaging accounts to spread malware even more This article explores konni apt threat. . A forensic investigation of a hacked system revealed the campaign.
It uses North Korean human rights themes to trick people into opening files that look completely safe. The attack began with emails that looked like official notices telling the recipients that they had been chosen to be North Korean human rights lecturers. The people who got these messages were meant to feel like they were relevant to their jobs, which made them seem real. There was a malicious LNK shortcut file in the email that was hidden behind a regular document icon.
People and businesses should think about the following to lower their risk of this threat: Check or quarantine archive attachments that have LNK shortcut files in them before they get to end users, especially if they have document icons on them. Use EDR solutions that can find unusual process chains after LNK execution, such as PowerShell spawning and registering scheduled tasks. Keep an eye on messaging apps on corporate endpoints for file transfers that are unusual or happen a lot and are not normal for the user.
Teach users to check the types of files before opening them and to report any attachments that seem suspicious, even if they come from a trusted contact. Block outgoing traffic to IP addresses and domains that aren't allowed, especially those that are known to be used by threat actors' confirmed C2 infrastructure.
