Bleepingcomputer

Konni Hackers Target Blockchain Engineers with AI Malware

First seen 24 Jan 2026, 20:38 UTC • •37.7

Article Content

1 / 10

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The North Korean hacker group Konni is utilizing AI-generated PowerShell malware to target developers and engineers in the blockchain sector. This campaign is linked to APT37 and Kimsuky activity clusters, with Konni having been active since at least 2014 and previously targeting organizations in South Korea, Russia, Ukraine, and various European countries.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

More articles in this cluster (9)

Threat Graph

9 entities, 16 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (5)

APT37
Kimsuky
Konni
Opal Sleet
TA406

Technique (1)

Malware

Affected Platform (1)

Discord

Tool (2)

OneDrive
PowerShell

Relationships

APT37 uses OneDrive
APT37 uses PowerShell
Kimsuky uses OneDrive
Kimsuky uses PowerShell
Konni uses OneDrive
Konni uses PowerShell
Opal Sleet uses OneDrive
Opal Sleet uses PowerShell
TA406 uses OneDrive
TA406 uses PowerShell
APT37 uses Malware
Kimsuky uses Malware
Konni uses Malware
Opal Sleet uses Malware
TA406 uses Malware
APT37 related to Discord

Following this threat?

Track APT37 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…