Russian Government Software Backdoored to Deploy Konni RAT Malware

An installer for a resource possible applied by the Russian Consular Department of the Ministry of Overseas Affairs (MID) has been backdoored to deliver a distant entry trojan termed Konni RAT (aka UpDog).

The conclusions occur from German cybersecurity firm DCSO, which connected the exercise as originating from the Democratic People’s Republic of Korea (DPRK)-nexus actors targeting Russia.

The Konni (aka Opal Sleet, Osmium, or TA406) exercise cluster has an established pattern of deploying Konni RAT against Russian entities, with the danger actor also joined to attacks directed towards MID at the very least due to the fact Oct 2021.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

In November 2023, Fortinet FortiGuard Labs disclosed the use of Russian-language Microsoft Phrase files to provide malware capable of harvesting sensitive details from compromised Windows hosts.

DCSO mentioned the packaging of Konni RAT in application installers is a strategy earlier adopted by the group in October 2023, when it was identified to leverage a backdoored Russian tax submitting software program named Spravki BK to distribute the trojan.

“In this instance, the backdoored installer seems to be for a instrument named ‘Statistika KZU’ (Cтатистика КЗУ),” the Berlin-based organization said.

“On the foundation of install paths, file metadata, and consumer manuals bundled into the installer, […] the program is meant for internal use inside of the Russian Ministry of Overseas Affairs (MID), specifically for the relaying of yearly report data files from abroad consular posts (КЗУ — консульские загранучреждения) to the Consular Division of the MID by using a secure channel.”

The trojanized installer is an MSI file that, when released, initiates the infection sequence to establish get hold of with a command-and-manage (C2) server to await even further recommendations.

The remote access trojan, which comes with capabilities for file transfers and command execution, is believed to have been put to use as early as 2014, and has also been used by other North Korean threat actors recognized as Kimsuky and ScarCruft (aka APT37).

It really is at this time not obvious how the risk actors managed to receive the installer, offered that it can be not publicly obtainable. But it is really suspected that the long background of espionage functions targeting Russia may possibly have helped them discover potential tools for subsequent attacks.

While North Korea’s focusing on of Russia is not new, the growth arrives amid expanding geopolitical proximity among the two countries. Condition media from the Hermit Kingdom documented this week that Russian President Vladimir Putin has supplied chief Kim Jong Un a luxury Russian-created auto.

“To some extent, this need to not occur as a shock escalating strategic proximity would not be anticipated to fully overwrite extant DPRK collection needs, with an ongoing need to have on the section of the DPRK to be able to evaluate and validate Russian international plan planning and targets,” DCSO explained.

Identified this article intriguing? Adhere to us on Twitter  and LinkedIn to go through far more unique material we article.