KONNI
Attribution profile
- Type
- Spy
- Location
- Russia
- Known incidents
- 3 incidents
- Sources
- 1 source
- First seen
- 2019-07-01
- Last seen
- 2019-07-01
- Updated
- 2026-10-11 04:33
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The Konni Group, also tracked as KONNI or UNKN, is a threat actor believed to operate from Russia and aligned with North Korean interests. It primarily targets government agencies and individuals with professional ties to North Korea, seeking to establish persistent remote access and data exfiltration. Initial access is achieved through spear‑phishing emails containing malicious Microsoft Word documents that use geopolitical lures about North Korea. The attachments employ macro code that checks the victim’s Windows architecture, executes hidden commands, and, in later waves, drops embedded binary payloads delivered as hex‑byte strings. These macros deploy the CARROTBAT dropper and, in some instances, the second‑stage CARROTBALL malware, which together install the SYSCON remote access trojan. SYSCON communicates with command‑and‑control servers over FTP, enabling stealthy data exfiltration. The group’s tooling shows evolution from simple macro‑based droppers to more complex binary loaders while retaining consistent use of FTP‑based C2 and North Korea‑themed decoys. Publicly reported operations include the Fractured Statue campaign (July‑October 2019) against a U.S. government agency and an earlier December 2017 intrusion of a British government agency where CARROTBAT was first observed. Attribution to the Konni Group is assessed with moderate confidence by researchers, who note the overlap of tactics with historic activity but acknowledge potential false‑flag risks.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 1 source.