Konni Hijacks KakaoTalk Accounts in Spear-Phishing Malware Campaign

Konni APT conducted a sophisticated multi-stage campaign that began with targeted spear‑phishing using malicious LNK shortcuts which executed PowerShell droppers and AutoIt-based loaders to install multiple RATs (EndRAT, RftRAT, RemcosRAT). The operator maintained long-term persistence, exfiltrated internal documents and account data, and hijacked KakaoTalk PC sessions to propagate malicious archives to contacts; the report includes detailed TTPs and IoCs (file hashes, domain drfeysal.com, and C2 IPs).