North Korea-linked Konni APT used Google Find Hub to erase data and spy on defectors

North Korea-linked Konni APT employed Google Find Hub to erase data and spy on defectors in September 2025,researchers warn. The campaign impersonated psychological counsellors and North Korean human rights activists, delivering malware disguised as stress-relief programs via KakaoTalk and compromising Google accounts to track locations and trigger remote device wipes.

Spear-phishing emails, masquerading as the National Tax Service, infected targeted individuals and allowed attackers to use compromised devices as relays to spread malware through KakaoTalk accounts. The operation leveraged MSI installers built with EMCO MSI Package Builder, executing AutoIt scripts to deploy multiple RATs, including RemcosRAT, QuasarRAT, and RftRAT, with C2 servers in Russia, Japan, and the Netherlands.

According to Genians Security Center, this campaign marks the first known use of Find Hub by a state-sponsored APT to remotely reset Android devices and wipe data. The report also notes that attackers exploited KakaoTalk PC sessions to spread malware and that, without EDR-style detection, actors can remain on infected systems for extended periods while harvesting data and surveilling victims.