KONNIMalware
KONNI is a remote access tool that security researchers assess has been used by North Korean cyber actors since at least 2014. KONNI has significant code overlap with the NOKKI malware family, and has been linked to several suspected North Korean campaigns targeting political organizations in Russia, East Asia, Europe and the Middle East; there is some evidence potentially linking KONNI to APT37.From MITRE ATT&CK
Last reported 9 days ago, by AhnLab ASEC1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“Callisto deployed CosmicPulse using RedFlick (a scheduled task-based delivery technique), while UAC-0099 attempted to disrupt AI analysis using GuardBreaker (an LLM-based obfuscation technique).”
- T1218.002Control Panel
“VHDX, LNK, PDF, HTA, WSF, MSI, and Control Panel applets were combined.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
September 2026 Threat Trend Report on APT Groups“APT-Q-95 APTTrend APTTrend202609 Callisto FamousChollima FamousSparrow Fireant JadeSleet Kimsuky KONNI MirageKitten NightEagle StarBlizzard Storm-3069 TraderTraitor TransparentTribe UAC-0099 UAT-11587 UTA0565”
Thanks — we review every report.