20230926_threat_inteligence_report_konniapt.pdf (5 MB)

Konni APT targeted South Korean unification and North Korean human-rights communities with spear-phishing emails that impersonated government or civic-event material. Genians documents lures tied to the NCNKHR founding meeting and Ministry of Unification reorganization material, delivered as ZIP files containing double-extension LNK files such as XLSX or PDF decoys. The LNK execution chain used embedded malicious commands, VBS and BAT scripts, partial obfuscation, and compromised Korean websites as intermediate infrastructure to leak host information and support follow-on activity. The report maps the campaign with Genian EDR telemetry and notes overlap with earlier Konni campaigns, including tax-themed and internet-bank security-mail lures.