Netskope Threat Labs

KONNI

ATP Sandbox Adv. HeuristicsNetskope IPS

Description

KONNI is a remote access tool that researchers assess North Korean cyber actors have used since at least 2014. It has significant code overlap with the NOKKI malware family, and researchers have linked it to campaigns targeting political organizations in Russia, East Asia, Europe, and the Middle East, with some evidence potentially connecting it to APT37.

Stats

First seen
May 2022
Last seen
September 2026

MITRE ATT&CK techniques

40 techniques across 11 tactics.

TA0001 Initial Access

TA0002 Execution

TA0003 Persistence

TA0004 Privilege Escalation

  • T1546Event Triggered Execution
  • T1548Abuse Elevation Control Mechanism

TA0005 Stealth

TA0006 Credential Access

  • T1555Credentials from Password Stores

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1033System Owner/User Discovery
  • T1049System Network Connections Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1680Local Storage Discovery

TA0009 Collection

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel
  • T1048Exfiltration Over Alternative Protocol
    • T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

TA0112 Defense Impairment

Alert name variants

Alert Name
Script-PowerShell.Trojan.Konni
Script-WScript.Trojan.Konni
Shortcut.Trojan.Konni
Win32.Trojan.Konni
Win64.Trojan.Konni

Related IPS Signatures

Signature Name
MALWARE-CNC Konni.C2 traffic detected

Related families

QakBotInvisiMolePlugXBisonalLatrodectus

References