#HappyVirus

Incident/Operation

2018-10-18 • 새로운 KONNI 캠페인 등장, '작전명 해피 바이러스(Operation Happy Virus)'

Operation HappyVirus was an October 2018 KONNI campaign named from development-path strings and a payload filename containing happy. Its main dropper carried two embedded resources: a legitimate-looking English-language news document and an executable payload. The resources used Korean settings, while the executable also contained a Chinese-language dialog resource. During execution, the embedded executable was transformed into damaged code and produced an error message. The campaign continued a KONNI development lineage visible in project-path artifacts from 2017 and 2018.

Tagged Reports

« Back