Friday, March 29, 2024

North Korean Hacker Group Deliver KONNI Rat Malware Using Weaponized Office Document

The North Korean threat actors under the Kimsuky Umbrella are using a piece of malware which is called KONNI.

KONNI is a RAT (Remote Administration Tool) that is under the radar for nearly 8 years since its identification in 2014.

The owners of KONNI have been attacking political institutions in South Korea and Russia.

They distributed the malware by impersonating government software by sending emails from compromised accounts. It seems that they have also used the covid mandates to enhance their malware campaign.

On January 5th, A new campaign targeted the Russian Ministry of Foreign Affairs. They got access to one of the high-value networks through stolen credentials and exploited all the trusted connections.

Attack Process

They have been leveraging on Microsoft Office documents which involved a multi-stage attack.

Although they used these documents just to accomplish to escalate privileges and evade detection, their ultimate goal was to install KONNI rat on target systems.

The KONNI rat is a .dll file which is supported with a .ini file.

The .dll consists of the functionality whereas the .ini file specifies the address of the command and control server. The new variant is not much different from the previous version but has certain advancements.

Many of the remote administration tool malware use protection for their strings in order to bypass the basic string analysis. The strings that were used in the KONNI rat were using base64 encoding for obfuscation.

Now, they are using AES encryption with a custom alphabet that changes from time to time which takes more time to decode.

This is applied to files too. KONNI rat used a .dll file and a .ini file. These files are now encrypted with AES encryption making them difficult to analyze.

A full detailed analysis of the KONNI rat is published which gives a better understanding of the techniques and methods used.

IOCs

A3CD08AFD7317D1619FBA83C109F268B4B60429B4EB7C97FC274F92FF4FE17A2
F702DFDDBC5B4F1D5A5A9DB0A2C013900D30515E69A09420A7C3F6EAAC901B12

Website

Latest articles

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles