Russian Government Software Backdoored to Deploy Konni RAT Malware

An installer for a resource possible applied by the Russian Consular Department of the Ministry of Overseas Affairs (MID) has been backdoored to deliver a distant entry trojan termed Konni RAT (aka UpDog).

The conclusions occur from German cybersecurity firm DCSO, which connected the exercise as originating from the Democratic People’s Republic of Korea (DPRK)-nexus actors targeting Russia.

The Konni (aka Opal Sleet, Osmium, or TA406) exercise cluster has an established pattern of deploying Konni RAT against Russian entities, with the danger actor also joined to attacks directed towards MID at the very least due to the fact Oct 2021.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

In November 2023, Fortinet FortiGuard Labs disclosed the use of Russian-language Microsoft Phrase files to provide malware capable of harvesting sensitive details from compromised Windows hosts.

DCSO mentioned the packaging of Konni RAT in application installers is a strategy earlier adopted by the group in October 2023, when it was identified to leverage a backdoored Russian tax submitting software program named Spravki BK to distribute the trojan.

“In this instance, the backdoored installer seems to be for a instrument named ‘Statistika KZU’ (Cтатистика КЗУ),” the Berlin-based organization said.

“On the foundation of install paths, file metadata, and consumer manuals bundled into the installer, […] the program is meant for internal use inside of the Russian Ministry of Overseas Affairs (MID), specifically for the relaying of yearly report data files from abroad consular posts (КЗУ — консульские загранучреждения) to the Consular Division of the MID by using a secure channel.”

The trojanized installer is an MSI file that, when released, initiates the infection sequence to establish get hold of with a command-and-manage (C2) server to await even further recommendations.

The remote access trojan, which comes with capabilities for file transfers and command execution, is believed to have been put to use as early as 2014, and has also been used by other North Korean threat actors recognized as Kimsuky and ScarCruft (aka APT37).

It really is at this time not obvious how the risk actors managed to receive the installer, offered that it can be not publicly obtainable. But it is really suspected that the long background of espionage functions targeting Russia may possibly have helped them discover potential tools for subsequent attacks.

While North Korea’s focusing on of Russia is not new, the growth arrives amid expanding geopolitical proximity among the two countries. Condition media from the Hermit Kingdom documented this week that Russian President Vladimir Putin has supplied chief Kim Jong Un a luxury Russian-created auto.

“To some extent, this need to not occur as a shock escalating strategic proximity would not be anticipated to fully overwrite extant DPRK collection needs, with an ongoing need to have on the section of the DPRK to be able to evaluate and validate Russian international plan planning and targets,” DCSO explained.

Identified this article intriguing? Adhere to us on Twitter  and LinkedIn to go through far more unique material we article.