APT37 hackers abuse Google Find Hub in Android data-wiping attacks

Genians attributes a KONNI campaign tied to North Korean actors (overlapping with APT37/Kimsuky) that uses KakaoTalk spear-phishing to deliver signed MSI/ZIP installers which deploy KONNI and secondary RATs (Remcos, Quasar, RftRAT) to exfiltrate credentials and then abuse Google Find Hub to GPS-locate and remotely factory-reset Android devices, preventing recovery and allowing the attackers to propagate via compromised KakaoTalk PC sessions; the report provides technical analysis, IoCs, and recommends MFA and rapid account recovery measures.