Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware

This article covers a cyberattack campaign by the North Korean hacking group Konni, which uses spear-phishing and KakaoTalk to spread malware.

• •Initial access is gained via a spear-phishing email disguised as a notice appointing the recipient as a North Korean human rights lecturer, containing a malicious LNK file in a ZIP attachment.
• •Executing the LNK file downloads a next-stage payload, establishes persistence via scheduled tasks, and displays a decoy PDF to distract the victim.
• •The malware deployed is EndRAT (written in AutoIt), a remote access trojan enabling file management, remote shell access, data transfer, and persistence.
• •Additional RAT families (RftRAT and RemcosRAT) were also found on the infected host, indicating the victim was considered high-value.
• •