Konni (Malware): news timeline & CVEs

Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures

Konni APT targets Ukraine with malicious LNK lures in 'Conflict Compass' campaign, using JavaScript and PowerShell for initial access.

North Korean APT group Konni has launched a new campaign targeting Ukrainian entities using malicious LNK file lures themed around the ongoing conflict. The operation, dubbed 'Conflict Compass,' uses document-based infection vectors to execute JavaScript and PowerShell payloads for initial access. This campaign is part of North Korea's ongoing integration of cyber operations into its national strategy.

SOCRadarupdated Sep 24, 13:39 UTC · 2d agofirst Sep 22, 10:30 UTC · 4d agoMalware in the wild 3 sources

The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia

Unit 42 uncovers the Fractured Block campaign using the CARROTBAT dropper to deliver SYSCON and OceanSalt malware in cryptocurrency-themed attacks across Southeast Asia.

Unit 42 identified 29 CARROTBAT dropper samples used in the Fractured Block campaign, delivering decoy documents on cryptocurrencies, exchanges, and Korean political topics. Early samples delivered the SYSCON RAT, which uses FTP for command and control, while later ones dropped the previously reported OceanSalt malware. CARROTBAT supports 11 decoy file formats and uses certutil to download and execute payloads. Initial discovery stemmed from a December 2017 spear phishing attack on a British government agency, with infrastructure overlap tying the campaign to KONNI activity.

Palo Alto Unit 42Aug 17, 12:22 UTC · Aug 17, 2026Malware

Konni

Timeline2 articles

Appears with

Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures

The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia