North Korean Konni Hackers Target Blockchain Engineers with AI-Generated Malware
North Korea's Konni hacking group, active since 2014 and linked to APT37 and Kimusky clusters, has launched a new campaign targeting blockchain engineers in the Asia-Pacific region. The malware, delivered via Discord links, compromises development environments to access sensitive assets including API credentials and digital wallets.
CheckPoint researchers identified samples submitted from Japan, India, and Australia. The attack chain begins with a ZIP archive containing a malicious LNK file that executes a PowerShell backdoor. The payload includes UAC bypass techniques and establishes persistent access through scheduled tasks.
This sophisticated operation highlights growing threats to cryptocurrency infrastructure. While no specific coins or exchanges were named in the campaign, the breach of development environments could expose credentials for multiple blockchain networks and trading platforms.
