Konni Hackers Use AI-Generated PowerShell Backdoor to Target Blockchain Developers

The Konni group, a North Korean threat actor active since at least 2014, has recently expanded its targeting beyond South Korea to include developers in Japan, Australia, and India. This shift is part of a broader campaign known as Operation Poseidon, which aims to infiltrate development environments by using AI-generated PowerShell malware.

As detailed in a report by Check Point Research, the group has been observed sending spear-phishing emails that masquerade as financial notifications, tricking recipients into downloading malicious ZIP files. These files contain a Windows shortcut that executes an AutoIt script, leading to the deployment of a remote access trojan named EndRAT.

The latest attacks leverage a multi-stage approach, starting with ZIP files that appear to contain project documents. The initial access vector remains unclear, but the process involves executing a PowerShell backdoor that can establish persistence and communicate with a command-and-control server.

In November 2025, Konni was noted for exploiting Google’s Find Hub to reset Android devices remotely, indicating a troubling escalation in their tactics. The use of AI tools to generate malware suggests an effort to streamline their operations and enhance the effectiveness of their attacks.

Implications for Cybersecurity

This campaign highlights the increasing sophistication of cyber threats, particularly as adversaries adopt AI technologies to enhance their malware capabilities. Organizations, especially those in the blockchain sector, must remain vigilant against such evolving threats.

Users should be aware of the signs of phishing attempts, such as unexpected financial notices or requests for sensitive information. Implementing robust email filtering and user education can help mitigate these risks.

Additionally, organizations should regularly review their security measures, including the security of third-party platforms like WordPress, to prevent exploitation by threat actors like Konni.

• Konni: A North Korean hacker group known for targeting individuals and organizations, primarily in South Korea.
• Operation Poseidon: The codename for Konni’s recent campaign targeting blockchain developers using AI-generated malware.
• EndRAT: A remote access trojan used by Konni to gain unauthorized access to systems.
• AI-Generated Malware: Malware created with the assistance of artificial intelligence tools, enhancing its effectiveness and sophistication.
• Spear-Phishing: A targeted phishing attack that uses personalized messages to trick individuals into revealing sensitive information.