North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices

North Korea’s KONNI APT has been observed using Google Find Hub to remotely wipe and track South Korean Android devices, in a campaign attributed to actors linked to North Korea’s Kimsuky and APT37 groups, according to Genians Security Center (GSC). The attack began with spear-phishing and social engineering, delivering malware disguised as a “stress-relief program” via KakaoTalk Messenger to psychological counsellors and North Korean human rights activists.

Once a device was compromised, the attackers used the victim’s KakaoTalk account to propagate the infection, and later triggered remote resets of Android devices after confirming the victim’s absence through Find Hub’s location query.

The core payload, Stress Clear.msi, was digitally signed to appear legitimate by a Chinese entity, Chengdu Hechenyingjia Mining Partnership Enterprise, and deployed an AutoIt-based script for persistence, surveillance and remote access, with RATs such as RemcosRAT, QuasarRAT and RftRAT embedded in the infection chain. The attackers reportedly deleted Gmail security alerts and cleared account activity logs to evade detection and sustain access during the disruption.