Konni hackers target blockchain engineers with AI-built malware
Recorded: Jan. 24, 2026, 7 p.m.
| Original | Summarized |
Konni hackers target blockchain engineers with AI-built malware News Featured Fortinet confirms critical FortiCloud auth bypass not fully patched Okta SSO accounts targeted in vishing-based data theft attacks Hackers exploit critical telnetd auth bypass flaw to get root Hackers get $1,047,000 for 76 zero-days at Pwn2Own Automotive 2026 Konni hackers target blockchain engineers with AI-built malware A lifetime of multi-device ad blocking is just $40 in this deal ShinyHunters claim to be behind SSO-account data theft attacks Malicious AI extensions on VSCode Marketplace steal developer data Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityKonni hackers target blockchain engineers with AI-built malware Konni hackers target blockchain engineers with AI-built malware By Bill Toulas January 24, 2026 The North Korean hacker group Konni (Opal Sleet, TA406) is using AI-generated PowerShell malware to target developers and engineers in the blockchain sector. The attack begins with the victim receiving a Discord-hosted link that delivers a ZIP archive containing a PDF lure and a malicious LNK shortcut file. The lure used in the phishing attackSource: Check Point Latest infection chainSource: Check Point The exposing stringSource: Check Point Privilege-based action diagramSource: Check Point Secrets Security Cheat Sheet: From Sprawl to Control Related Articles: AI Malware Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Fortinet admins report patched FortiGate firewalls getting hacked Hackers breach Fortinet FortiGate devices, steal firewall configs Zendesk ticket systems hijacked in massive global spam wave Sponsor Posts Overdue a password health-check? Audit your Active Directory for free Exposure Management Index: Insights From 3,000+ Teams. Get The Report. Discover how phishing kits are sold and deployed. Download the full research report. Identity Governance & Threat Detection in one: Get a guided tour of our platform Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Konni, a North Korean hacker group associated with APT37 and Kimsuky, is utilizing AI-generated PowerShell malware in a recent campaign targeting blockchain engineers. The operation, identified as TA406, has been active since 2014 and has previously targeted organizations in South Korea, Russia, Ukraine, and across Europe. This latest iteration, observed across Japan, Australia, and India, demonstrates a significant shift in development tactics, strongly suggesting AI assistance. The attack begins with a phishing campaign delivering a ZIP archive containing a malicious LNK shortcut file. This lure, disguised as a PDF, prompts the victim to execute the shortcut, initiating the malware’s sequence. Upon execution, the LNK file triggers an embedded PowerShell loader that extracts a DOCX document and a CAB archive. The CAB contains a PowerShell backdoor, two batch files, and a UAC bypass executable, allowing the attackers to escalate privileges on compromised systems. Crucially, the malware exhibits characteristics strongly indicative of AI-assisted development. Check Point researchers pinpointed this through several key markers. Firstly, the script’s clear, structured documentation, uncommon in traditional malware development, is a telling sign. Secondly, the script’s modular, clean layout reflects a deliberate design process often associated with AI-generated code. Finally, the presence of a comment – "# <– your permanent project UUID” – is a hallmark of AI-produced scripts and tutorials, where the model explicitly instructs the user to customize a placeholder. Once launched, the PowerShell backdoor performs hardware, software, and user activity checks to avoid detection in analysis environments before establishing a unique host ID. The malware then dynamically adapts its execution path based on available privileges, communicating periodically with a command-and-control (C2) server. If the C2 responds with PowerShell code, the backdoor executes it asynchronously through background jobs, showcasing a sophisticated level of obfuscation and dynamic behavior. The C2 server receives host metadata and polls the server at randomized intervals, adding another layer of complexity to evade detection. This dynamic communication strategy, combined with the AI-influenced design, suggests a concerted effort by Konni to maintain operational security and minimize the risk of attribution. Check Point has published indicators of compromise (IoCs) associated with this campaign to assist defenders in mitigating the threat. The group's operational approach, leveraging AI-generated code, represents a concerning trend in cybercrime, potentially lowering the barrier to entry for sophisticated attacks and demanding a shift in defense strategies. The evolution of malware development, coupled with the attackers' resourcefulness, necessitates continuous monitoring, proactive threat hunting, and robust security controls for blockchain-related infrastructure. |