QiAnXin Threat Intelligence Center (RedDrip)
Analysis of Konni Group's Espionage Operation Using Email Security Inspection Manual as Bait · 2023-12-20T10:31:46.000Z
Konni initially surfaced as a type of remote access Trojan (RAT) disclosed by the Cisco Talos team in 2017. Its activities trace back to 2014, targeting regions such as Russia and South Korea. In 2018, Palo Alto identified connections between this malware and the APT37 (also known as Reaper, Group123, Scarcruft) Trojan NOKKI. Starting in 2019, South Korean security firm ESTsecurity reported and disclosed Konni as a suspected APT group with East Asian ties, finding some associations with Kimsuky.