To Russia With Love: Assessing a KONNI-Backdoored Suspected Russian Consular Software Installer

Earlier this year, DCSO observed an intriguing malware sample first uploaded to VirusTotal in mid-January 2024 that we believe to be part of North Korea-linked activity targeting the Russian Ministry of Foreign Affairs.

The malware itself appears to be KONNI, a North Korea (DPRK) nexus tool believed to have been used since as early as 2014. The use of KONNI in highly similar activity targeting the Russian Ministry of Foreign Affairs was previously observed by various researchers in a …

dprk installer january january 2024 konni korea love malware malware analysis nexus north north korea russia russian russian ministry sample software targeting tool virustotal we believe