{"id":10088,"date":"2026-01-23T10:03:41","date_gmt":"2026-01-23T10:03:41","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/23\/north-korean-hackers-adopted-ai-to-generate-malware-attacking-developers-and-engineering-teams\/"},"modified":"2026-01-23T10:03:41","modified_gmt":"2026-01-23T10:03:41","slug":"north-korean-hackers-adopted-ai-to-generate-malware-attacking-developers-and-engineering-teams","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/23\/north-korean-hackers-adopted-ai-to-generate-malware-attacking-developers-and-engineering-teams\/","title":{"rendered":"North Korean Hackers Adopted AI to Generate Malware Attacking Developers and Engineering Teams"},"content":{"rendered":"

North Korean Hackers Adopted AI to Generate Malware Attacking Developers and Engineering Teams
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

North Korea\u2013aligned hackers have launched a new campaign that turns artificial intelligence into a weapon against software teams. <\/p>\n

Using AI-written PowerShell code, the group known as KONNI is delivering a stealthy backdoor that blends real project content with malicious scripts. <\/p>\n

This operation shows how fast threat actors are adopting AI tools to speed up development and hide their tracks.<\/p>\n

In the latest wave, KONNI is targeting developers and engineering teams working on blockchain and crypto projects across the Asia\u2011Pacific region, including Japan, Australia, and India. <\/p>\n

The attackers craft detailed requirement papers that look like real product briefs, describing trading bots, credential systems, and delivery roadmaps, then deliver them as PDF lures.<\/p>\n

\n
\"Blockchain
Blockchain themed lures used in this campaign (Source \u2013 Check Point) <\/figcaption><\/figure>\n<\/div>\n

These documents are designed to win the trust of technical staff and draw them into opening attached shortcut files that silently start the infection chain.<\/p>\n

Check Point researchers identified<\/a> the activity as part of the long\u2011running KONNI cluster and noted that the payload is an AI\u2011generated PowerShell backdoor with extensive comments and clean structure. <\/p>\n

This backdoor does more than open a remote door; it gathers hardware details, checks for debugging tools<\/a>, and ensures only one copy runs at a time, all while maintaining a professional, developer\u2011style layout.<\/p>\n

For victim organizations, the risk goes far beyond a single compromised workstation. By targeting developers who hold access to repositories, cloud consoles, and signing keys, KONNI can pivot from one infected endpoint into entire build pipelines or production systems.<\/p>\n

Infection Chain and Persistence Tactics<\/strong><\/h2>\n

The attack begins when a target opens the ZIP archive and double\u2011clicks a Windows shortcut file that sits next to the PDF lure. <\/p>\n

That shortcut runs an embedded PowerShell<\/a> loader, which quietly drops a second lure document and a compressed CAB archive.<\/p>\n

\n
\"Infection
Infection Chain (Source \u2013 Check Point)<\/figcaption><\/figure>\n<\/div>\n

From there, batch files unpacked from the CAB archive move the backdoor into a hidden ProgramData folder and create a scheduled task that mimics a OneDrive startup entry. <\/p>\n

\n
\"Privilege-Based
Privilege-Based Execution Flow (Source \u2013 Check Point)<\/figcaption><\/figure>\n<\/div>\n

This task runs every hour, decrypts the PowerShell payload from disk using a simple XOR key, and executes it directly in memory, keeping the core malware<\/a> file\u2011less during runtime and making incident response far more difficult.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post North Korean Hackers Adopted AI to Generate Malware Attacking Developers and Engineering Teams<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

North Korean Hackers Adopted AI to Generate Malware Attacking Developers and Engineering Teams North Korea\u2013aligned hackers have launched a new campaign that turns artificial intelligence into a weapon against software teams. Using AI-written PowerShell code, the group known as KONNI is delivering a stealthy backdoor that blends real project content with malicious scripts. This operation […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-10088","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10088"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10088"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10088\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}