Konni APT Hijacks KakaoTalk Accounts to Spread Malware in Multi-Stage Spear-Phishing Campaign

Konni APT conducted a targeted spear-phishing campaign using archive attachments with malicious LNK shortcuts that silently launch a PowerShell loader to retrieve AutoIt-based RATs. The intruder maintained long dwell time to collect documents and account data, hijacked the KakaoTalk PC application to distribute malicious files to contacts, and established persistent access via scheduled tasks and geographically distributed C2 servers.