TF-MAL-apk.konni
📛 Threat Title
Malware family: Konni
Description
ThreatFox malware family `apk.konni`. Printable name: Konni.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.konni
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.konni
IOC database
- Type
- domain
- Value
apk.konni- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.konni
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.konni
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
KONNI is a remote access tool that security researchers assess has been used by North Korean cyber actors since at least 2014. KONNI has significant code overlap with the NOKKI malware family , and has been linked to several suspected North Korean campaigns targeting political organizations in Russia, East Asia, Europe and the Middle East; there is some evidence potentially linking KONNI to ...
-
web:blog.checkpoint.com
North Korea-linked KONNI targets developers with phishing lures and AI-generated malware , shifting focus to blockchain, crypto, and technical environments.
-
web:cyber-kill-chain.ch
KONNI KONNI is a Windows remote administration too that has been seen in use since 2014 and evolved in its capabilities through at least 2017. KONNI has been linked to several campaigns involving North Korean themes. [1] KONNI has significant code overlap with the NOKKI malware family . There is some evidence potentially linking KONNI to APT37.
-
web:cybersecuritynews.com
A sophisticated multi-stage malware campaign linked to the North Korean Konni APT group has been detected targeting organizations primarily in South Korea. Security researchers uncovered the operation on April 29, 2025, revealing a complex attack chain designed to establish persistent access and exfiltrate sensitive information from compromised systems. The campaign demonstrates the continued ...
-
web:labs.cloudsecurityalliance.org
Defenders should not assume that removing one malware family or blocking one C2 server constitutes full remediation ; complete incident response for Konni -attributed intrusions requires full forensic review of the compromised endpoint and network for all three tool families and their associated persistence mechanisms.
-
web:malpedia.caad.fkie.fraunhofer.de
Konni is a remote administration tool, observed in the wild since early 2014. The Konni malware family is potentially linked to APT37, a North-Korean cyber espionage group active since 2012. The group primary victims are South-Korean political organizations, as well as Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East.
-
web:redpiranha.net
Notably, KONNI shares a substantial code base with the NOKKI malware family . Konni's APT group maintains its focus on attacking documents written in Russian, often related to Russian-North Korean trade and economic investments.
-
web:rewterz.com
Adversaries employ Konni RAT to gather information from victims, capture screenshots, steal files, and build a remote interactive shell. KONNI has been linked to various alleged North Korean attacks targeting political groups in Russia, East Asia, Europe, and the Middle East. KONNI shares a significant code overlap with the NOKKI malware family .
-
web:securityaffairs.com
Check Point links an active phishing campaign to North Korea-aligned KONNI , using an AI-written PowerShell backdoor.
-
web:www.bleepingcomputer.com
The North Korean hacker group Konni (Opal Sleet, TA406) is using AI-generated PowerShell malware to target developers and engineers in the blockchain sector.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.