North Korea Invades Russia With RAT

Researchers discovered a campaign carried out by the North Korea-linked Konni APT group aimed at Russian diplomatic entities that used new versions of malware implants.

The APT group carried out spear-phishing attacks using New Year’s Eve festivities as a lure. Upon opening the malicious email attachment, a multi-stage attack chain starts, the final payload is a new version of the Konni RAT family.

The malicious activity starts from an email containing a malicious zip file, which once decompressed drops a malicious downloader able to activate a complex chain of actions finalized to deploy Konni RAT malware, named scrnsvc.dll, as Windows service. The RAT was able to avoid detection due to continuous evolution, it is able of executing arbitrary code on the target systems and stealing data. The Konni RAT has been attributed to North Korea-linked threat actors tracked as Thallium and APT37.

The activity of the APT group aimed at Russian targets in the diplomatic sector since August 2021. On December 20, the group targeted the Russian Embassy located in Indonesia with spear-phishing messages using the New Year Eve 2022 festivity as decoy theme.

The spear-phishing messages used a .zip attachment named “поздравление.zip” instead of weaponized office documents, the archive contains executables that acts as the first stage malware. The spoofed messages used a *@mid.ru account as a sender to trick the victims into believing that it was sent from the Russian Embassy in Serbia.

The Windows x32 executable in the archive, named “поздравление.scr,” was compiled on Dec 20 09:16:02 2021, a circumstance that suggests it was specifically developed to the operation that was uncovered by the C25 team.

The final payload is a x64 Konni RAT version compiled on Dec 20 09:02:38 2021. The attribution of the attacks to the Konni APT group is based on the similarities of the implant used with previous versions of the Konni RAT, and significant overlap of the kill-chain with the TTPs linked to North Korean linked group, and the use of CAB files as infection stage.

Indicators of Compromise