From Kakao to Killswitch: KONNI’s RAT Rampage in Korea

In the world of high-stakes cyber espionage, some groups prefer brute-force attacks, while others prefer the "long con." KONNI, a notorious North Korean threat actor linked to Kimsuky and APT37, has recently perfected the latter.

By late 2025, researchers at the Genians Security Center (GSC) uncovered a chilling new campaign that leverages the intimacy of messaging apps and the vulnerability of psychological distress to compromise those most at risk: North Korean defectors and human rights activists.

---

1. The Trap: "Stress Relief" via KakaoTalk

The campaign, detected in September 2025, begins with a social engineering masterstroke. Attackers pose as counselors or human rights advocates on KakaoTalk, South Korea’s most popular messaging platform.

They offer victims what seems like a helping hand: a "stress-relief app" designed to help defectors cope with the trauma of relocation. In reality, these apps are digital Trojan horses. Once a victim downloads the malicious APK or ZIP file, the trap is sprung.

2. The Infection: A Cocktail of RATs

KONNI doesn’t rely on a single tool; they deploy a versatile "Attack Weapon" folder that includes a mix of well-known and custom malware. The initial foothold is often gained through Lilith RAT or EndRAT, which immediately begin:

• Data Exfiltration: Siphoning contacts, messages, and files.
• Webcam Spying: Silently activating the camera to monitor the victim's surroundings.
• Persistence: Establishing connections to command-and-control (C2) servers located in Russia, the Netherlands, and Japan.

As the infection scales, the group often deploys heavy hitters like RemcosRAT and QuasarRAT to maintain long-term control over the compromised device.

3. The Killswitch: Hijacking Google Find Hub

What makes this specific campaign terrifying is a novel tactic involving Google Find Hub (formerly Find My Device). After gaining access to a victim's hijacked Google account, KONNI leverages the phone's own security features against the user.

By using Find Hub, the attackers can:

1. Track Locations: Precisely monitor the physical movements of activists.
2. Remote Wipe: Execute a factory reset on the Android device.

This isn't just about deleting files; it’s a "killswitch" that erases all evidence of the intrusion while simultaneously cutting the victim off from their digital life and contacts.

4. Evasion and Evolution

KONNI has been active since 2017, and they have become experts at staying under the radar. Their toolkit utilizes a mix of VBS, BAT, PowerShell, and CHM files to bypass traditional security filters.

Because they often abuse legitimate cloud services, WordPress sites, and FTP servers for their C2 infrastructure, their traffic looks like normal web noise. Furthermore, the use of kill switches within their malware allows them to self-destruct if they detect they are being analyzed by security researchers.

5. How Genians Caught the Trail

The Genians Security Center (GSC) was able to link this campaign to North Korea by identifying specific linguistic traces in the code and tracking the overlap in TTPs (Tactics, Techniques, and Procedures) with known APT37/Kimsuky activity.

Genians’ detection edge comes from monitoring abnormal behavioral patterns—such as a "stress relief" app suddenly requesting access to Google account security settings—rather than just looking for known file signatures.

6. Defending Against the KONNI Threat

As North Korean APTs continue to target unification groups and even financial assets like Bitcoin traders, the defense must be multi-layered:

• Trust Nothing: Be extremely skeptical of unsolicited files or apps sent via KakaoTalk, even if they appear to come from a sympathetic source.
• Enable MFA: Ensure that your Google and KakaoTalk accounts use Multi-Factor Authentication to prevent account takeovers.
• Update and Monitor: Keep Android OS updated and use EDR (Endpoint Detection and Response) tools that can flag suspicious background processes like remote wipes.

KONNI’s move from simple data theft to remote device destruction marks a aggressive shift in how state-sponsored groups operate in the mobile era.

_{Posted using SteemX}