Konni Uses KakaoTalk to Spread EndRAT in Targeted Phishing Campaigns

Post Views: 8

Recent Phishing Campaign by Konni Threat Group

A recent phishing campaign attributed to the Konni threat group has been uncovered, utilizing the EndRAT malware to compromise victims and exploit their KakaoTalk accounts.

Initial Infection

The operation began with a spear-phishing email, masquerading as a notice appointing the recipient as a lecturer on North Korean human rights. The email contained a ZIP archive with a malicious shortcut file, which, when executed, initiated the infection chain.

Malware Capabilities

The attackers used a layered approach, employing the EndRAT remote access trojan to gain sustained access to the compromised machine. EndRAT, written in AutoIt, provided the operators with a range of capabilities, including remote shell access, file management, and data transfer.

The malware allowed the attackers to browse, query, and manipulate the infected device at will.

Propagation through KakaoTalk

The campaign’s most notable feature was the use of the victim’s KakaoTalk desktop application as a propagation channel. The attackers selectively sent malicious ZIP archives to specific contacts in the victim’s list, leveraging the legitimacy of an already authenticated account to lower suspicion.

Selectivity and Human Decision-Making

The campaign demonstrated a high degree of selectivity, with the attackers choosing specific contacts and sending them malicious files. This suggests human decision-making within the operation, with the attackers reviewing relationships, inferring relevance, and selecting targets worth approaching.

Local Character of Cyber Operations

The use of KakaoTalk reflects the increasingly local character of cyber operations, as threat groups adapt their techniques to the software habits of particular regions or sectors.

Broader Pattern of North Korean-Linked Cyber Activity

The latest findings fit into a broader pattern of North Korean-linked cyber activity, characterized by campaigns that blur the line between espionage, credential theft, social manipulation, and operational persistence.

Evolution of Tactics

The attackers’ use of KakaoTalk in this campaign echoes a previous operation in late 2025, in which they abused already signed-in KakaoTalk sessions to send malicious ZIP files to victims’ contacts. The latest activity appears to build upon this model, demonstrating an evolution in the group’s tactics and a focus on continuity rather than spectacle.

Importance of Social Architecture

This campaign highlights the importance of social architecture in modern intrusion campaigns, as attackers increasingly depend on messaging platforms, address books, saved logins, and familiar patterns of exchange to expand their reach.

The compromise of a system no longer ends with the endpoint; it expands outward, through the relationships stored inside it.