North Korean Hackers Use AI to Generate Malware Targeting Developers and Engineers

A new phishing campaign linked to KONNI, a North Korea–aligned threat actor active since at least 2014.

The group, traditionally known for spying on South Korean diplomatic, academic, NGO, and government targets, is now shifting its focus toward software developers and engineering teams working with blockchain and crypto infrastructures across the APAC region, including Japan, Australia, and India.

These documents include details such as system architecture, tech stacks, timelines, and even budgets. The goal is to trick developers and engineers into opening them, allowing the attackers to gain access to sensitive assets like infrastructure, API keys, wallet access, and potentially cryptocurrency funds.

In this campaign, KONNI uses lure documents that appear to be legitimate project files for blockchain and cryptocurrency initiatives.

Multiple samples from this operation were uploaded to VirusTotal from Japan, Australia, and India, signaling that KONNI is no longer limiting itself to South Korean targets.

This broader targeting suggests a shift toward financially motivated and access-focused operations aimed at development environments.

Discord-hosted payload

The attack starts with a Discord-hosted link that delivers a ZIP archive, likely delivered through spear-phishing.

The ZIP file contains a PDF lure and a malicious Windows shortcut (LNK) file. When the victim opens the LNK, it silently runs an embedded PowerShell loader.

This loader drops two more files to disk: a DOCX lure document and a CAB archive, both hidden and XOR-encoded. The DOCX is opened to keep the user distracted, while the CAB is extracted in the background. Inside the CAB are:

• A PowerShell backdoor.
• Two batch files.
• An executable used for bypassing User Account Control (UAC).

The first batch script creates a folder under C:\ProgramData, moves the malicious files there, and sets up a scheduled task disguised as a “OneDrive Startup Task.”

This task runs hourly, decrypts the PowerShell backdoor using a single-byte key, and executes it directly in memory, leaving minimal traces on disk.

AI-generated PowerShell backdoor

The most notable part of this campaign is the PowerShell backdoor itself, which is generated with the help of AI. The script is unusually well-structured, with clear comments and documentation, such as:

“This script ensures that only one instance of this UUID-based project runs at a time. It sends system info via HTTP GET every 13 minutes.”

It also contains a very AI-style comment:

# <– your permanent project UUID.

This kind of instructional placeholder is typical of code produced by large language models. The backdoor uses heavy obfuscation, anti-sandbox checks, mouse-click monitoring, process blacklists, and privilege-aware behavior.

It can elevate privileges using a fodhelper-based UAC bypass, disable UAC prompts, exclude C:\ProgramData from Windows Defender, and deploy a legitimate remote management tool (SimpleHelp) for long-term access.

This campaign shows how a mature APT like KONNI is combining traditional spear-phishing and multi-stage Windows infection chains with AI-generated malware.

By targeting developers and engineering teams in blockchain and crypto projects across APAC, the attackers are aiming for high-value access and long-term control, while AI helps them speed up development and produce cleaner, more maintainable malicious code.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.