CyberSIXT Search
Threat actor

Konni

North Korea

Tracked by CyberSIXT since 10 Nov 2025

Articlesall time
11
Articleslast 30 days
1
CVEs exploitedattributed · all time
0
Research reportsall time
1

11 articles from 5 outlets since 10 Nov 2025; the latest 28 days ago.

Konni: coverage over time11 articles from 5 outlets, 10 of them before 25 Oct 2025. First report 10 Nov 2025 by The Hacker News. Busiest week: 1 articles, week of 28 Sep. 0 in the last 7 days. Konni: coverage over time11 articles from 5 outlets, 10 of them before 25 Oct 2025. First report 10 Nov 2025 by The Hacker News. Busiest week: 1 articles, week of 28 Sep. 0 in the last 7 days.
  • Article
  • First report
  • Research report
Show as table
Konni: articles
Published (UTC)OutletHeadline
Mon 28 Sep · 07:00 UTCSecurityOnlineNorth Korean Konni Group Targets Think Tanks with Stealthy Malware
Tue 17 Mar · 10:37 UTCThe Hacker NewsKonni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware
Mon 26 Jan · 16:36 UTCDark ReadingDPRK's Konni Targets Blockchain Developers With AI-Generated Backdoor
Mon 26 Jan · 11:35 UTCSecurity AffairsNorth Korea–linked KONNI uses AI to build stealthy malware tooling
Mon 26 Jan · 09:10 UTCThe Hacker NewsKonni Hackers Deploy AI-Generated PowerShell Backdoor Against Blockchain Developers
Mon 26 Jan · 01:45 UTCSecurityOnlineCode by AI: KONNI APT Targets Crypto Devs with “Polished” Backdoor
Thu 22 Jan · 14:01 UTCCheck PointKONNI Adopts AI to Generate PowerShell Backdoors
Tue 20 Jan · 01:46 UTCSecurityOnlineOperation Poseidon: Konni APT Hijacks Google & Naver Ads for Malware
Tue 11 Nov 2025 · 12:31 UTCSecurity AffairsNorth Korea-linked Konni APT used Google Find Hub to erase data and spy on defectors
Tue 11 Nov 2025 · 01:00 UTCSecurityOnlineNorth Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices
Mon 10 Nov 2025 · 21:35 UTCThe Hacker NewsKonni Hackers Turn Google’s Find Hub into a Remote Data-Wiping Weapon
See the full timeline

Profile

Written by CyberSIXT from the sources listed below. Updated 26 Oct.

Microsoft tracks Konni under the following names APT43, OSMIUM, Opal Sleet, Planedown and VELVET CHOLLIMA3. Microsoft classifies Konni as a state actor and attributes its origin to KP, an origin also recorded by MISP Galaxy1,2,4. Malpedia and MISP Galaxy list Konni, OSMIUM, Opal Sleet and Vedalia together as names for the actor5,6. MISP Galaxy records a similarity relationship between Konni and the group identified as G00867.

Sources

  1. Konni: category · Microsoft
  2. Konni: origin · Microsoft
  3. Konni: alias · Microsoft
  4. Konni: origin · MISP Galaxy
  5. Konni: alias · Malpedia
  6. Konni: alias · MISP Galaxy
  7. Konni: related · MISP Galaxy

Names and sources

Opal Sleet
CyberSIXT coverage, Malpedia, Microsoft, MISP Galaxy
Konni
Malpedia, Microsoft, MISP Galaxy, CyberSIXT coverage
OSMIUM
Malpedia, Microsoft, MISP Galaxy
Vedalia
Malpedia, MISP Galaxy
APT43
Microsoft
Planedown
Microsoft
VELVET CHOLLIMA
Microsoft
Konni APT
CyberSIXT coverage

Attributed facts

Origin

North Korea Microsoft · Opal Sleet, MISP Galaxy

Category

State Microsoft · Opal Sleet

MITRE ATT&CK® techniques

No MITRE ATT&CK® techniques are recorded for Konni.

Coverage

11 articles, all timeFull timeline RSS feed
  1. North Korean Konni Group Targets Think Tanks with Stealthy MalwareSecurityOnline
  2. Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate MalwareThe Hacker News
  3. DPRK's Konni Targets Blockchain Developers With AI-Generated BackdoorDark Reading
  4. North Korea–linked KONNI uses AI to build stealthy malware toolingSecurity Affairs
  5. Konni Hackers Deploy AI-Generated PowerShell Backdoor Against Blockchain DevelopersThe Hacker News
  6. Code by AI: KONNI APT Targets Crypto Devs with “Polished” BackdoorSecurityOnline
  7. KONNI Adopts AI to Generate PowerShell BackdoorsCheck Point
  8. Operation Poseidon: Konni APT Hijacks Google & Naver Ads for MalwareSecurityOnline
  9. North Korea-linked Konni APT used Google Find Hub to erase data and spy on defectorsSecurity Affairs
  10. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android DevicesSecurityOnline
  11. Konni Hackers Turn Google’s Find Hub into a Remote Data-Wiping WeaponThe Hacker News · first in our coverage

Research reports

Related actors

Learn more

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device