Konni Hackers Deploy AI-Generated PowerShell Backdoor

The Konni threat group, a North Korean state-linked actor active since 2014, has been observed deploying AI-generated PowerShell malware in a campaign targeting blockchain developers and engineering teams across Japan, Australia, and India.

Campaign Overview

• Operation Poseidon:
  • Delivered via spear-phishing emails disguised as financial notices (transaction confirmations, wire transfers).
  • Malicious ZIP archives hosted on WordPress and Discord CDN.
  • ZIP contains:
    • PDF decoy.
    • LNK shortcut → launches embedded PowerShell loader.
    • CAB archive → PowerShell backdoor, batch scripts, UAC bypass executable.

Attack Chain

1. Initial lure: ZIP archive with PDF decoy + LNK file.
2. Loader stage: LNK executes PowerShell loader → extracts Word lure + CAB archive.
3. Backdoor deployment:
   • CAB archive drops PowerShell backdoor, batch scripts, UAC bypass executable.
   • Batch script establishes persistence via scheduled task, then self-deletes.
4. Privilege escalation:
   • Backdoor uses FodHelper UAC bypass.
   • Cleans up dropped executables.
   • Configures Microsoft Defender exclusions for C:\ProgramData.
5. Persistence & remote access:
   • Drops SimpleHelp RMM tool for long-term access.
   • Communicates with C2 server via encrypted gate to evade detection.
6. Capabilities:
   • Anti-analysis & sandbox evasion.
   • System profiling.
   • Executes PowerShell code returned by C2.

AI-Assisted Malware

• Evidence suggests the backdoor was AI-generated:
  • Modular structure.
  • Human-readable documentation.
  • Source code comments like # <– your permanent project UUID.
• Goal: accelerate development, standardize code, and improve evasion.

Broader Context

• Konni aliases: Earth Imp, Opal Sleet, Osmium, TA406, Vedalia.
• Past activity:
  • Exploited Google’s Find Hub to reset Android devices remotely (Nov 2025).
  • Distributed EndRAT via ad-click redirection (Google/Naver).
• Other NK-linked campaigns:
  • JSE scripts mimicking HWPX docs → VS Code tunnel.
  • LNK masquerading as PDFs → MoonPeak RAT.
  • Andariel group supply chain attacks → StarshellRAT, JelusRAT, GopherRAT.

Defensive Recommendations

• Email security: Harden against spear-phishing with attachment and URL filtering.
• Endpoint monitoring: Watch for suspicious PowerShell activity, CAB extraction, and Defender exclusions.
• Persistence hunting: Check for rogue scheduled tasks and SimpleHelp RMM installations.
• Network defense: Monitor encrypted outbound traffic to unknown C2 endpoints.
• Developer environments: Apply strict access controls—attackers are targeting dev teams for downstream compromise.

Takeaway

Konni’s use of AI-generated PowerShell backdoors signals a new phase in cyber operations, where adversaries blend automation, social engineering, and trusted tools to infiltrate high-value developer environments. This campaign underscores the need for advanced detection of living-off-the-land techniques and vigilance in blockchain and software supply chain sectors.