The North Korea–linked hacking group Konni, also tracked as Opal Sleet and TA406, has been observed deploying an AI-generated PowerShell backdoor in a campaign aimed at developers and engineers working in the blockchain sector.
Active since at least 2014 and often associated with APT37 and Kimsuky activity clusters, Konni has a long history of targeting organizations across South Korea, Russia, Ukraine, and multiple European countries. In its latest operation, researchers identified a renewed focus on the Asia-Pacific region, with malware samples submitted from Japan, Australia, and India.
According to analysis by Check Point researchers, the attack chain begins with a Discord-hosted link that delivers a ZIP archive. This archive contains a decoy PDF file alongside a malicious LNK shortcut. When executed, the shortcut launches an embedded PowerShell loader that drops a DOCX lure and a CAB archive holding the PowerShell backdoor, two batch files, and a UAC bypass executable.
Opening the shortcut triggers the DOCX document while simultaneously executing one of the batch files. The content of the lure document indicates an attempt to compromise development environments, potentially granting attackers access to sensitive resources such as infrastructure components, API keys, cryptocurrency wallets, and digital assets.
The first batch file creates a staging directory for the backdoor and associated files, while the second establishes an hourly scheduled task disguised as a OneDrive startup process. This task decrypts an XOR-encrypted PowerShell script and executes it directly in memory before deleting itself to reduce forensic traces.
AI-Assisted Malware Design
The PowerShell backdoor is heavily obfuscated through arithmetic-based string encoding, runtime string reconstruction, and execution via Invoke-Expression. Check Point notes that several characteristics strongly suggest AI-assisted development rather than manually written malware.
Indicators include unusually clear documentation within the script, a clean and modular structure, and comments such as “# ← your permanent project UUID,” which are commonly seen in large language model–generated code and tutorials. Researchers highlight that such phrasing typically reflects AI-generated guidance rather than traditional threat actor conventions.
Before execution, the malware conducts checks on hardware, software, and user activity to evade sandbox and analysis environments. It then generates a unique host identifier and proceeds along different execution paths depending on the privilege level available on the infected system.
Once active, the backdoor regularly communicates with its command-and-control (C2) server, sending basic host information and polling at randomized intervals. Any PowerShell code received from the C2 is converted into script blocks and executed asynchronously using background jobs.
Check Point attributes the campaign to the Konni threat actor based on similarities with previous operations, including launcher formats, lure filenames, script naming conventions, and execution chain structure. To support defensive efforts, the researchers have released indicators of compromise (IoCs) related to this campaign, enabling organizations to better detect and mitigate the threat.
Comments