KONNI

The KONNI sample we discovered appears to have been distributed via a backdoored installer for a Russian-language tool named “Statistika KZU”... Both installers came in the form of an MSI file with the malware integrated into the benign installation process.

Microsoft disclosed a March 2023 case in which an account linked to Konni Group targeted Russian “diplomatic government entities” with phishing e-mails... The late 2021 campaign... leveraged tools such as spoofed MID login portals for credential harvesting, a fake malicious installer... and trojanized screensaver attachments to target MID personnel.

The content repeatedly describes threat actors and malware being delivered through phishing or spearphishing emails containing malicious attachments such as Microsoft Office documents, PDFs, RAR/ZIP archives, CHM, ISO, IMG, HTA, LNK, and executable files disguised as documents.

KONNI’s recent command set has remained largely unchanged and only permits operators to execute commands and receive their output...

The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."

In both cases, another batch file is eventually executed, which is responsible for copying the files and setting up the Windows service for persistence and execution simultaneously, as well as copying the included configuration alongside the payload file.

When a user runs the backdoored installer, a CustomAction triggers execution of the first stage... we have observed a VBScript and a small executable performing the same tasks.

AppleSeed has the ability to use JavaScript to execute PowerShell. APT32 has used JavaScript for drive-by downloads and C2 communications. Astaroth uses JavaScript to perform its core functionalities.

Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

another batch file is eventually executed, which is responsible for copying the files and setting up the Windows service for persistence and execution simultaneously... The service name is chosen to be inconspicuous, with “Windows image Acquisition Service” being very similar to an existing, legitimate Windows service.

Examples include malware copied to '%AppData%\Microsoft\Windows\Start Menu\Programs\Startup', creation of '.lnk' shortcuts in Startup, and scripts or batch files placed in Startup folders. | The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, or .lnk files in the Startup folder.

another batch file is eventually executed, which is responsible for copying the files and setting up the Windows service for persistence and execution simultaneously... The service name is chosen to be inconspicuous, with “Windows image Acquisition Service” being very similar to an existing, legitimate Windows service.

Examples include malware copied to '%AppData%\Microsoft\Windows\Start Menu\Programs\Startup', creation of '.lnk' shortcuts in Startup, and scripts or batch files placed in Startup folders. | The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, or .lnk files in the Startup folder.

The configuration file copied during the malware installation process contains the C2 servers and is encrypted using AES-CTR, with the service name used as key.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

The service name is chosen to be inconspicuous, with “Windows image Acquisition Service” being very similar to an existing, legitimate Windows service.

Akira has used legitimate names and locations for files to evade defenses.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

When a user runs the backdoored installer, a CustomAction triggers execution of the first stage, which detects the environment (32/64 bit) and selects the appropriate payload.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

The campaign occurred in multiple stages, leveraging tools such as spoofed MID login portals for credential harvesting...

The content repeatedly describes threat actors and malware stealing usernames, passwords, cookies, session tokens, and other saved credentials from web browsers such as Chrome, Firefox, Internet Explorer, Edge, Opera, Safari, and Yandex.

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

For a check-in, KONNI runs the following commands and sends the output to the C2: systeminfo tasklist

For a check-in, KONNI runs the following commands and sends the output to the C2: systeminfo tasklist

The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").

When a user runs the backdoored installer, a CustomAction triggers execution of the first stage, which detects the environment (32/64 bit) and selects the appropriate payload.

The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.

The campaign occurred in multiple stages, leveraging tools such as spoofed MID login portals for credential harvesting...

Agent Tesla can steal data from the victim’s clipboard. APT38 used a Trojan called KEYLIME to collect data from the clipboard. APT39 has used tools capable of stealing contents of the clipboard.

For file transfers, KONNI checks the extensions against a list of file types it transfers as is. Other file extensions are compressed into a .CAB archive and then sent.

Communication is done via HTTP.

KONNI’s recent command set has remained largely unchanged and only permits operators to execute commands and receive their output, upload and download files...

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

Elise exfiltrates data using cookie values that are Base64-encoded... KONNI has used a custom base64 key to encode stolen data before exfiltration... Kevin can Base32 encode chunks of output files during exfiltration.