KONNI Adopts AI to Generate PowerShell Backdoors

According to Check Point Research, a phishing campaign linked to a North Korea–aligned threat actor known as KONNI is being observed targeting software developers and engineering teams, with activity extending across the APAC region including Japan, Australia, and India. The campaign uses lure content framed as legitimate project documents tied to blockchain and crypto initiatives, and features an AI-written PowerShell backdoor that demonstrates AI-assisted tooling within KONNI’s operations.

The infection chain begins with a Discord-hosted link that downloads a ZIP containing a PDF lure and a Windows shortcut, which in turn leads to a PowerShell loader and multiple embedded components, including a CAB archive with a PowerShell backdoor, batch files, and an executable used for UAC bypass.

The backdoor employs anti-analysis checks, a single-instance mutex, and a C2 that initially authenticates via a JavaScript challenge before exchanging commands, with activity suggesting persistence through scheduled tasks and a focus on accessing blockchain-related assets. Notably, the report highlights an AI-generated backdoor and discusses early samples from October 2025 that used a modular, multi-script infection chain. January 22, 2026.