North Korean Hackers Use AI To Craft Malware Targeting Developers and Engineers

A phishing campaign by North Korean-linked KONNI group, using AI-generated PowerShell backdoors to target developers and engineers in APAC.

North Korean hackers from the KONNI APT group have escalated their tactics, adopting AI to create sophisticated PowerShell backdoors.

Check Point Research (CPR) links this to a phishing operation targeting software developers and engineering teams, especially those handling blockchain and crypto projects.

Unlike KONNI’s usual focus on South Korea’s diplomatic and government sectors, this campaign expands to Japan, Australia, and India. Lures mimic legitimate project docs with tech stacks, timelines, and budgets to snag access to APIs, wallets, and crypto assets.

Campaign Mechanics and AI Backdoor

The attack kicks off with a Discord link downloading a ZIP. Inside: a PDF lure and LNK shortcut. The LNK drops a DOCX decoy and XOR-encoded CAB via PowerShell.

The CAB unpacks the AI-crafted backdoor (zVJs.ps1), two BAT files, and a UAC bypass exe.

A first-stage BAT creates C:\ProgramData\VljE, moves files, and sets a fake “OneDrive Startup Task” scheduled hourly. It XOR-decrypts the backdoor (key: ‘Q’) and runs it in memory:

textschtasks /create /sc hourly /mo 1 /tn "OneDrive Startup Task..." /tr "cmd /c powershell -w h $d=[IO.File]::ReadAllBytes(...)"

The backdoor uses arithmetic obfuscation, building strings from math ops for IEX execution.

Comments like “# <– your permanent project UUID” and polished docs scream AI generation modular sections with human-like instructions, rare in APT malware.

Evasion starts strong: checks CPU/RAM thresholds, scans for IDA, Wireshark, Procmon; monitors mouse clicks.

Mutex Global\SysInfoProject_f7d77a6d-36e0-4fcb-bae7-5f4b3b723f61 ensures single instance. It hashes motherboard serial + system UUID + campaign ID via SHA-256 for host ID.

Privilege handling:

• User: Fodhelper UAC bypass via registry hijack (HKCU\Software\Classes\ms-settings to .thm handler), runs rKXujm.exe to disable UAC (sets SystemConsentPromptBehaviorAdmin=0).
• Admin: Cleans up, adds Defender exclusion for C:\ProgramData, upgrades scheduled task to SYSTEM.
• System: Deploys SimpleHelp RMM for remote access.

C2: Emulates JS challenge for __test cookie, bypassing AES anti-bot. Polls PHP endpoint every 13 mins with host ID, IP, user; executes returned PS code async. Blacklists persist.

Earlier October 2025 variants used PS loader fetching VBS/BAT/OneDriveUpdater.exe (drops SimpleHelp).

Attribution and Implications

TTPs match KONNI: LNK structure, modular BAT/VBS chains, overlapping lures like Avinash_CV.lnk. Shifts show maturation AI speeds tooling, blockchain lures chase financial gains, APAC expansion.

This marks North Korean actors’ AI pivot, blending old phishing with new tech for dev env footholds, as reported by Checkpoint.

File Hashes (from Check Point Report)​

Paths and Persistence​

• Staging dir: C:\ProgramData\VljE\
• Scheduled task: “OneDrive Startup Task-S-1-5-21-3315426051-1901789636-3309192473-4545” (hourly, PS decrypt/execute)
• Defender exclusion: C:\ProgramData\
• Earlier: OneDriveUpdate.ps1, simi.bat, start.vbs, schedule1.bat

Behavioral IOCs​

• Mutex: Global\SysInfoProject_f7d77a6d-36e0-4fcb-bae7-5f4b3b723f61
• XOR key: ‘Q’ (single-byte)
• UUID: f7d77a6d-36e0-4fcb-bae7-5f4b3b723f61
• Blacklist tools: IDA, Wireshark, Procmon
• UAC bypass: HKCU\Software\Classes\ms-settings\CurVer → .thm; HKCU\Software\Classes.thm\Shell\Open\command; HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemConsentPromptBehaviorAdmin=0
• RMM: SimpleHelp
• C2: PHP endpoint (emulates JS AES challenge for __test cookie); polls every 13 min with host ID (SHA256 of WMI serial+UUID)

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.