A group of hackers from North Korea, KONNI, used malware.

A group of hackers from North Korea, KONNI, used Backdoor malware written in AI to attack the victim.

If it comes to a nation that is not a great power, but has some of the best hackers in the world, it can't escape a small country like North Korea that can be hit every day by hacking and malware. With the latest work from this news, many people will be worried again.

According to a report by the website Security Affair, it discusses the detection of a new campaign of hackers from North Korea, KONNI, also known as Kimsuky, Earth Imp, TA406, Thallium, Vedalia, and Velvet Chollima, which is a victim fraud campaign with Phishing, focusing its victims on a group of software developers (Developers) in the Asia-Pacific area, or APAC, using a fake project document file purporting to be a new project involving blockchain technology, and Krypto Kerrenzi C to trick victims into downloading. The area of the malware epidemic is unknown. South Korea, a longtime antagonist of North Korea, gradually spread to other countries such as Japan, Australia and India.

As for the embedding of the malware on the machine, sources have explained that it will start with a group of hackers sending a link to the victim, claiming that it is a new project that requires the victim to participate. The link is a link of a file deposited on the system of the Discord chat network. When the victim presses the link, it will download a zip file that, when the file is broken, two files will appear. One is a PDF file for distracting the victim (Decoy) and an Internet Shortcut file of the LNK genus that has the illusion of naming a file similar to a file of the genus. DOCX. If the victim presses to open the file, it will lead to a PowerShell script running on the file to decompress two files. The first will be a real .DOCX file with the same name as Shortcut in most respects (but a phantom document), and the other will be a compressed CAB file with a malware file (Payload). These two are encoded to the LNK file with an XOR encryption method using a single-byte key.

After that, the script within the CAB file creates a malware persistence on the system by creating a task scheduling table and naming the task as the normal operation of the OneDrive system. Then, it runs malware for opening the back door of the system (Backdoor) in the form of a PowerShell script that can confuse the Obfuscation. This part will run directly on memory, making it difficult to detect.

And the key part is in the Backdoor, which came in the PowerShell script format, where a research team from Check Point, a cyberdefense specialist company that detects such malware, said that by examining the code, there are many points to believe that it was written with the use of AI or Artificial Intelligence in the large language model (LLM or Large Language Model). Whether it is Verbose Documentation, Modular Layout Design, and Computer Instructional Comments, such as "Your permanent project UUID," all indicate that they are created by LLM AI. And the research team also said that compared to malware and other attack methods, it can be patched up to the conclusion that the KONNI group is behind the malware and this campaign, based on the use of LNK files and malware that are unique to this group of hackers.

In addition to the remarkable fact that this malware is AI-generated, it also has many different capabilities - Sandbox Evasion, Anti-Analysis, Verification of Malware Users as Permitted Users (Interaction Validation), and Single Instance Enforcement via Global Mutex. Not only does it have a Fingerprint Host key to control the C2 server or Command and Control tracking (Tracking) according to the privilege level of the victim's system, The ability to emanate UAC Account Control (User Account Control) with Windows Defender, Remote Monitoring and Management software to create Persistence. Hackers can log in to the victim at any time, including copying JavaScript Challenges to emanate the web browser's protection system. This allows the reception of commands and smuggling of files to C2 servers.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # it