Know What's Happening in Crypto

Konni Hackers Target Blockchain Engineers with AI-Built Malware

North Korean hacker group Konni, linked to APT37, is deploying AI‑generated PowerShell malware to infiltrate blockchain developers. The campaign uses Discord‑hosted links that deliver a ZIP file containing a PDF lure and a malicious LNK shortcut. The shortcut triggers a PowerShell loader that extracts a DOCX, a CAB archive, and a backdoor with XOR‑encrypted scripts, UAC‑bypass, and scheduled‑task persistence. Check Point’s analysis highlights AI‑assisted code patterns, indicating a new level of automation in threat actor tooling.