Konni RAT Resurfaces: North Korean Espionage Malware Evolves with Stealth and Persistence

Cyfirma’s analysis details Konni RAT, a sophisticated Windows Remote Access Trojan that employs a multi-stage infection chain (malicious .lnk, PowerShell, VBScript, batch files, and a CAB payload) to collect system information and user files, exfiltrate them to a C2 server (roofcolor.com), and maintain persistence via registry Run keys while erasing traces; the report attributes usage to APT37 and links the tool to espionage campaigns targeting government entities including the Russian Ministry of Foreign Affairs.