CampaignPublished 22 Jan 2026Updated 21 Feb 2026

KONNI Adopts AI to Generate PowerShell Backdoors

Source AlienVault OTX General

Description

A North Korea-linked threat actor known as KONNI has been observed conducting a phishing campaign targeting software developers and engineering teams, particularly those with blockchain expertise. The campaign uses AI-generated PowerShell backdoors and targets a broader range of countries in the APAC region. The infection chain begins with a Discord-hosted link downloading a ZIP archive containing a PDF lure and a malicious LNK file. The LNK file deploys additional components, including the AI-generated PowerShell backdoor. The backdoor employs various anti-analysis techniques and establishes persistence through scheduled tasks. This campaign demonstrates KONNI's evolution in tactics and tooling, including the adoption of AI-assisted malware development.

Impact

For European organizations, particularly those involved in blockchain development and software engineering, this threat poses risks including unauthorized access, intellectual property theft, and potential disruption of development workflows. The AI-generated PowerShell backdoor's anti-analysis features complicate detection and incident response, increasing dwell time and potential data exfiltration. Persistence via scheduled tasks can enable long-term access, facilitating espionage or further lateral movement within networks. Given the targeting of blockchain expertise, organizations involved in cryptocurrency, decentralized finance, or blockchain infrastructure could face confidentiality breaches impacting competitive advantage and regulatory compliance. The phishing vector exploiting Discord links may bypass traditional email security controls, requiring enhanced user awareness and endpoint monitoring. While the campaign currently focuses on APAC, the global nature of software development and blockchain ecosystems means European entities could become targets, especially those with cross-regional collaborations or supply chain connections. The medium severity reflects the targeted nature and complexity of the attack, balanced against the lack of widespread exploitation or known vulnerabilities.

Defensive guidance

European organizations should implement targeted defenses including: 1) Enhancing email and messaging platform filtering to detect and block Discord-hosted malicious links and ZIP archives containing suspicious LNK files. 2) Deploying endpoint detection and response (EDR) solutions capable of identifying PowerShell-based backdoors and monitoring for unusual scheduled task creations. 3) Conducting focused security awareness training for software developers and blockchain teams emphasizing the risks of phishing via non-traditional channels like Discord. 4) Applying application whitelisting to restrict execution of unauthorized LNK files and PowerShell scripts. 5) Utilizing threat intelligence feeds to monitor for indicators of compromise related to KONNI and AI-generated malware. 6) Implementing network segmentation to limit lateral movement if a developer workstation is compromised. 7) Regularly auditing scheduled tasks and startup entries for unauthorized persistence mechanisms. 8) Encouraging multi-factor authentication (MFA) on all developer and engineering accounts to reduce credential theft impact. 9) Collaborating with industry groups focused on blockchain security to share intelligence and best practices. These measures go beyond generic advice by focusing on the unique delivery vector, AI-generated payloads, and persistence techniques observed in this campaign.

Indicators of compromise

IP addresses 3

192.144.34.40
192.144.34.77
223.16.184.105

Hashes 51

002ff972edcda2ff895181bfa1c9cb70
0cbd4017870b914c6d543fb529cea2c3
1a677e0ce4c10840c09d8d414b3a8f5c
2eebb492567f5d4727c2812a151ead68
7e2a888794702e475fdca586a136fede
a553b78847aea7dbb6746a4ee4b98a3b
a56220a0b2a69c6b950693c813ce5fea
c3fcb261849b8fab17f8263ae851860b
dd91777f53c11cea51c393b6997c0392
fdc2a430e9438e2e9290c50cb82fe94b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jan 2026, 20:50 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

IP addresses 3

Hashes 51

Community reviews

Related threats