Russian Ministry Software Backdoored with North Korean KONNI Malware

German firm DCSO identified a KONNI malware sample (uploaded to VirusTotal in Jan 2024) linked to DPRK-associated actors and targeting the Russian Ministry of Foreign Affairs by backdooring a Russian consular software installer (Statistika KZU). The report details KONNI's capabilities (MSI-based deployment, AES-CTR encrypted C2, HTTP comms, file upload/download, CAB compression), delivery via a compromised installer containing user manuals, and contextualizes the finding with previous KONNI campaigns and geopolitical ramifications.