Malware.View on attack.mitre.org
KONNI is a remote access tool that security researchers assess has been used by North Korean cyber actors since at least 2014. KONNI has significant code overlap with the NOKKI malware family, and has been linked to several suspected North Korean campaigns targeting political organizations in Russia, East Asia, Europe and the Middle East; there is some evidence potentially linking KONNI to APT37.
| Technique | Procedure example |
|---|---|
| T1005 Data from Local System |
KONNI has stored collected information and discovered processes in a tmp file. |
| T1016 System Network Configuration Discovery |
KONNI can collect the IP address from the victim’s machine. |
| T1027.002 Software Packing |
KONNI has been packed for obfuscation. |
| T1027.013 Encrypted/Encoded File |
KONNI is heavily obfuscated and includes encrypted configuration files. |
| T1033 System Owner/User Discovery |
KONNI can collect the username from the victim’s machine. |
| T1036.004 Masquerade Task or Service |
KONNI has pretended to be the xmlProv Network Provisioning service. |
| T1036.005 Match Legitimate Resource Name or Location |
KONNI has created a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file. |
| T1041 Exfiltration Over C2 Channel |
KONNI has sent data and files to its C2 server. |
| T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol |
KONNI has used FTP to exfiltrate reconnaissance data out. |
| T1049 System Network Connections Discovery |
KONNI has used |
| T1056.001 Keylogging |
KONNI has the capability to perform keylogging. |
| T1057 Process Discovery |
KONNI has used the command |
| T1059.001 PowerShell |
KONNI used PowerShell to download and execute a specific 64-bit version of the malware. |
| T1059.003 Windows Command Shell |
KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain. |
| T1059.007 JavaScript |
KONNI has executed malicious JavaScript code. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
