Threat actor
Konni
Tracked by CyberSIXT since 10 Nov 2025 · last activity 28 Sep
- articles · all time
- 11+0 this week
- outlets
- 5
- week of 26 Jan · busiest week
- 4
11 articles from 5 outlets since 10 Nov 2025; the latest 28 days ago.
- Article
- First report
- Research report
Show as table
Who reported 5 outlets, last 12 months
- SecurityOnline4
- The Hacker News3
- Security Affairs2
- Check Point1
- Dark Reading1
CVEs
No CVE is named alongside Konni in CyberSIXT coverage.
- North Korean Konni Group Targets Think Tanks with Stealthy MalwareSecurityOnline
- Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate MalwareThe Hacker News
- DPRK's Konni Targets Blockchain Developers With AI-Generated BackdoorDark Reading
- North Korea–linked KONNI uses AI to build stealthy malware toolingSecurity Affairs
- Konni Hackers Deploy AI-Generated PowerShell Backdoor Against Blockchain DevelopersThe Hacker News
- Code by AI: KONNI APT Targets Crypto Devs with “Polished” BackdoorSecurityOnline
- KONNI Adopts AI to Generate PowerShell BackdoorsCheck Point
- Operation Poseidon: Konni APT Hijacks Google & Naver Ads for MalwareSecurityOnline
- North Korea-linked Konni APT used Google Find Hub to erase data and spy on defectorsSecurity Affairs
- North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android DevicesSecurityOnline
- Konni Hackers Turn Google’s Find Hub into a Remote Data-Wiping WeaponThe Hacker News · first in our coverage