Bleepingcomputer

Konni Hackers Target Blockchain Engineers with AI Malware

First seen 24 Jan 2026, 20:38 UTC • Research.Checkpoint

+2 •37.7

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The North Korean hacker group Konni is utilizing AI-generated PowerShell malware to target developers and engineers in the blockchain sector. This campaign is linked to APT37 and Kimsuky activity clusters, with Konni having been active since at least 2014 and previously targeting organizations in South Korea, Russia, Ukraine, and various European countries.

How this analysis works

Attack Flow

13 entities, 36 inferred relationships (STIX 2.1).

Threat Actor (5)

Apt37
Kimsuky
Konni
Opal Sleet
Ta406

Technique (5)

Malware
T1027 - Obfuscated/Compressed Files and Information
T1053 - Scheduled Task/Job
T1059 - Command and Scripting Interpreter
T1548.002 - Abuse Elevation Control: Bypass User Account Control

Affected Platform (1)

Discord

Tool (2)

OneDrive
PowerShell

Relationships

Apt37 uses OneDrive
Apt37 uses PowerShell
Kimsuky uses OneDrive
Kimsuky uses PowerShell
Konni uses OneDrive
Konni uses PowerShell
Opal Sleet uses OneDrive
Opal Sleet uses PowerShell
Ta406 uses OneDrive
Ta406 uses PowerShell
Apt37 uses Malware
Apt37 uses T1027 - Obfuscated/Compressed Files and Information
Apt37 uses T1053 - Scheduled Task/Job
Apt37 uses T1059 - Command and Scripting Interpreter
Apt37 uses T1548.002 - Abuse Elevation Control: Bypass User Account Control
Kimsuky uses Malware
Kimsuky uses T1027 - Obfuscated/Compressed Files and Information
Kimsuky uses T1053 - Scheduled Task/Job
Kimsuky uses T1059 - Command and Scripting Interpreter
Kimsuky uses T1548.002 - Abuse Elevation Control: Bypass User Account Control
Konni uses Malware
Konni uses T1027 - Obfuscated/Compressed Files and Information
Konni uses T1053 - Scheduled Task/Job
Konni uses T1059 - Command and Scripting Interpreter
Konni uses T1548.002 - Abuse Elevation Control: Bypass User Account Control
Opal Sleet uses Malware
Opal Sleet uses T1027 - Obfuscated/Compressed Files and Information
Opal Sleet uses T1053 - Scheduled Task/Job
Opal Sleet uses T1059 - Command and Scripting Interpreter
Opal Sleet uses T1548.002 - Abuse Elevation Control: Bypass User Account Control
Ta406 uses Malware
Ta406 uses T1027 - Obfuscated/Compressed Files and Information
Ta406 uses T1053 - Scheduled Task/Job
Ta406 uses T1059 - Command and Scripting Interpreter
Ta406 uses T1548.002 - Abuse Elevation Control: Bypass User Account Control
Apt37 related to Discord

Continue Reading

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies MuddyWater Targets U.S. Entities Amid Geopolitical Tensions ScarCruft's Supply-Chain Attack Targets Yanbian Gaming Platform with BirdCall Malware New NarwhalRAT Malware Targets Korean Users via Phishing Emails APT37 Launches Targeted Cyberattack Using Social Media and Tampered Software North Korean Konni Group Uses KakaoTalk for Malware Distribution in Spear-Phishing Campaign

Konni Hackers Target Blockchain Engineers with AI Malware

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading