Check Point Research
KONNI Adopts AI to Generate PowerShell Backdoors · 2026-01-22
Check Point Research (CPR) is tracking a phishing campaign linked to a North Korea–aligned threat actor known as KONNI.
KONNI Adopts AI to Generate PowerShell Backdoors
- Date (as written)
- 2026-01-22
- Year
- 2026
Source entries (3)
Check Point Research
26th January – Threat Intelligence Report · 2026-01-26
Check Point Research identified an ongoing phishing campaign associated with KONNI, a North Korean–linked threat actor active since at least 2014. The campaign targets software developers and engineering teams across the Asia-Pacific region, including Japan, Australia, and India, using blockchain-themed lures to prompt interaction and deliver malicious content. In observed activity, the threat actor deploys AI-generated PowerShell backdoors that establish persistence, steal credentials, and enable infiltration of development environments
Hackmageddon cyber attacks timelines (Paolo Passeri)
Blockchain and software engineers · 22/01/2026
Researchers at Check Point reveal that the Konni group is targeting blockchain engineers via LinkedIn, using AI-generated malware disguised as technical coding assessments. By tricking victims into downloading malicious repositories, the attackers deploy a remote access trojan (RAT) to steal sensitive information and credentials from developers in the cryptocurrency and fintech sectors. [Date Occurred: During January 2026; Date Discovered: During January 2026]