MITRE ATT&CKsoftware (malware)
S0356 KONNI
- Domain
- enterprise
- Platforms
- Windows
- Version
- 2.2
- Created
- 2019-01-31
Description
KONNI is a remote access tool that security researchers assess has been used by North Korean cyber actors since at least 2014. KONNI has significant code overlap with the NOKKI malware family, and has been linked to several suspected North Korean campaigns targeting political organizations in Russia, East Asia, Europe and the Middle East; there is some evidence potentially linking KONNI to APT37.
Related
Uses · MITRE ATT&CK (40)
- T1680 Local Storage Discovery technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1059.007 JavaScript sub-technique
- T1546.015 Component Object Model Hijacking sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1560 Archive Collected Data technique
- T1134.002 Create Process with Token sub-technique
- T1134.004 Parent PID Spoofing sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1056.001 Keylogging sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.002 Software Packing sub-technique
- T1070.004 File Deletion sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1547.009 Shortcut Modification sub-technique
- T1218.011 Rundll32 sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1016 System Network Configuration Discovery technique
- T1033 System Owner/User Discovery technique
References
- https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/ Unit 42 Nokki Oct 2018
- https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/ Unit 42 NOKKI Sept 2018
- https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b Medium KONNI Jan 2020
- https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html Talos Konni May 2017
- https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/ Malwarebytes Konni Aug 2021