New KONNI Malware attacking Eurasia and Southeast Asia

guest · Oct 1, 2018

New KONNI Malware attacking Eurasia and Southeast Asia
September 27, 2018
https://researchcenter.paloaltonetw...nni-malware-attacking-eurasia-southeast-asia/

Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks.

Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI.
Conclusion
The adversary operating the NOKKI malware family appears to have begun using NOKKI in January 2018 and has continued their activity through 2018.

The NOKKI malware itself has been updated in the short period of time it has been observed, moving from FTP to HTTP for C2 operations. The malware is modular in nature, and based on analysis of the information gathering module, it is highly likely the NOKKI operators are the same as the KONNI operators.
Click to expand...

Minimalist · Oct 2, 2018

NOKKI Malware Sports Mysterious Link to Reaper APT Group

The Reaper APT group, suspected of being affiliated with North Korea, turns out to have a link to the recently uncovered NOKKI malware family.

Palo Alto’s Unit 42 recently observed NOKKI-laden attacks targeted Russian- and Cambodian-speaking individuals with political lures. NOKKI is a backdoor, first observed between January 2018 to May 2018 using a remote FTP server to ultimately accept commands and download additional modules. Newer versions of NOKKI then started appearing in June 2018 – these use HTTP.
Click to expand...

https://threatpost.com/nokki-malware-sports-mysterious-link-to-reaper-apt-group/

guest · Aug 25, 2021

Konni RAT variant targeting Russia in ongoing attack campaign
...only 3 security solutions on VirusTotal were able to detect the malware
August 24, 2021
https://www.hackread.com/konni-rat-variant-hits-russia-ongoing-attack/

The IT security researchers at Malwarebytes Labs have reported a new and ongoing malware campaign in which the prime target is Russia. The payload dropped by threat actors in this attack is the Konni RAT that was first spotted in 2014 being used by the North Korean Black Hat group of hackers known as Thallium and APT37.

On the other hand, on July 6th, 2017, days after its missile test, North Korea was also hit by Konni RAT. At that time, Kaspersky Lab claimed that the hackers behind Konni malware campaigns might be of Korean origin, and the attacks were probably originating from South Korea.
Click to expand...

In a blog post, Hossein Jazi of Threat Intelligence Team emphasized that Konni RAT is potentially motivated used by APT37 to target political organizations in Russia and South Korea. However, Jazi warned that Konni’s is not limited to these countries as its infection has also been observed in countries like:

Japan

Nepal

Mongolia

Vietnam

Click to expand...

Malwarebytes Labs: New variant of Konni malware used in campaign targetting Russia

We discovered two documents written in Russian language and weaponized with the same malicious macro. One of the lures is about the trade and economic issues between Russia and the Korean Peninsula. The other one is about a meeting of the intergovernmental Russian-Mongolian commission.

In this blog post we provide on overview of this campaign that uses two different UAC bypass techniques and clever obfuscation tricks to remain under the radar.
Click to expand...

guest · Jan 7, 2022

North Korea-linked Konni APT targets Russian diplomatic bodies
January 6, 2022

Security researchers at Cluster25 uncovered a recent campaign carried out by the North Korea-linked Konni APT group aimed at Russian diplomatic entities that used new versions of malware implants.

The APT group carried out spear-phishing attacks using New Year’s Eve festivities as a lure. Upon opening the malicious email attachment, a multi-stage attack chain starts, the final payload is a new version of the Konni RAT family.

“The malicious activity starts from an email containing a malicious zip file, which once decompressed drops a malicious downloader able to activate a complex chain of actions finalized to deploy Konni RAT malware, named scrnsvc.dll, as Windows service.” reads the report published by Cluster25.
Click to expand...

The Konni RAT has been attributed to North Korea-linked threat actors tracked as Thallium and APT37.

The attribution of the attacks to the Konni APT group is based on the similarities of the implant used with previous versions of the Konni RAT, and significant overlap of the kill-chain with the TTPs linked to North Korean linked group, and the use of CAB files as infection stage.
Click to expand...

Cluster25: North Korean Group “KONNI” Targets The Russian Diplomatic Sector With New Versions Of Malware Implants

Cluster25 analyzed a recent attack linked to the North Korean APT group “Konni” targeting Russian diplomatic sector using a spear phishing theme for New Year’s Eve festivities as lure.

Once the malicious email attachment is opened and executed, a chain composed by multiple stages is triggered, allowing actor to install an implant belonging to the Konni RAT family as final payload.
Click to expand...

guest · Jul 24, 2022

Is APT28 behind the STIFF#BIZON attacks attributed to North Korea-linked APT37?
North Korea-linked APT37 group targets high-value organizations in the Czech Republic, Poland, and other countries
July 24, 2022

Researchers from the Securonix Threat Research (STR) team have uncovered a new attack campaign, tracked as STIFF#BIZON, targeting high-value organizations in multiple countries, including Czech Republic, and Poland. The researchers attribute this campaign to the North Korea-linked APT37 group, aka Ricochet Chollima.

The attackers employed the Konni RAT (remote access trojan), which was first spotted by Cisco Talos researchers in 2017 and has been undetected since 2014 while being employed in highly targeted attacks. The RAT was able to avoid detection due to continuous evolution, it is able of executing arbitrary code on the target systems and stealing data.
The Konni RAT has been attributed to North Korea-linked threat actors tracked as Thallium and APT37.
Click to expand...

The attack chain starts with phishing messages that attempt to trick victims into opening a malicious attachment.
To further maintain persistence, threat actors use a modified version of the Konni malware, they are able to download a .cab file containing several files related to the malware (bat, dll, dat, ini, dll).

The experts also discuss the possibility of false flag operations where the Russia-lined APT28 group may be masquerading as APT37.

“Additionally, there seems to be a direct correlation between IP addresses, hosting provider and hostnames between this attack and historical data we’ve previously seen from FancyBear/APT28[3]. In the end, what makes this particular case interesting is the usage of Konni malware in conjunction with tradecraft similarities to APT28.” concludes the report.
Click to expand...

Securonix Threat Labs Initial Coverage Advisory: STIFF#BIZON Detection Using Securonix – New Attack Campaign Observed Possibly Linked to Konni/APT37 (North Korea)

The Securonix Threat Research (STR) team has been observing and investigating a new attack campaign exploiting high-value targets, including Czech Republic, Poland, and other countries. The attack campaign has been tracked by STR as STIFF#BIZON.

Based on the tradecraft and artifacts observed by the Threat Research team as part of this on-going campaign, some of the artifacts and tradecraft observed are known to be associated with Konni (APT37 in North Korea) malicious activity (see details below.)
Background
Konni malware is classified as a RAT (remote access trojan) which was heavily used by APT37, contains built-in functions to elevate privileges and maintain persistence on the affected host. This particular malware was discovered in 2014 and has been attributed to the North Korean APT37 group[3].
Click to expand...

Log in or Sign up

New KONNI Malware attacking Eurasia and Southeast Asia

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

New KONNI Malware attacking Eurasia and Southeast Asia

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches