Konni Hackers Turn Google’s Find Hub into a Remote Data-Wiping Weapon

According to Genians Security Center (GSC), the North Korea-affiliated threat actor Konni (also known as Earth Imp, Opal Sleet, Osmium, TA406, and Vedalia) has launched a new set of attacks on Android and Windows devices for data theft and remote control. The group impersonated psychological counsellors and North Korean human rights activists, distributing malware disguised as stress-relief programs.

Notably, attacks targeting Android devices weaponised Google's Find Hub (formerly Find My Device) to remotely reset victim devices and delete personal data. The activity was detected in early September 2025 and marks the first time the hacking group has weaponised legitimate management functions for remote device resets. The initial intrusion involved spear-phishing emails to gain access, followed by utilisation of KakaoTalk sessions to propagate the malware via a ZIP archive.

The malware drop includes a ZIP-delivered MSI package named Stress Clear.msi, which uses a valid signature from a Chinese company to appear legitimate, with subsequent commands enabling remote control and data exfiltration.