#konni — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #konni, aggregated by home.social.
-
Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell Malware
North Korea-linked threat actors are conducting Operation Conflict Compass, targeting individuals and organizations focused on Ukraine using spear-phishing emails with malicious ZIP attachments. These contain LNK files disguised as PDFs with themes related to Russia-Ukraine peace plans, Ukrainian research, and geopolitical issues. When executed, the shortcuts retrieve malicious files from GitHub, deploying VBScript to establish persistence via scheduled tasks and delivering VelvetCake, a lightweight PowerShell-based task runner. VelvetCake contacts command-and-control infrastructure to download and execute additional scripts that perform reconnaissance, collect system information, enumerate security software, and capture screenshots. The campaign also utilized trojanized Zoom installers and leveraged infrastructure in South Korea and Ukraine, with activity observed since early August 2026 targeting diplomatic entities, think tanks, and NGOs.
Pulse ID: 6ab51a43ec94931b637c0607
Pulse Link: https://otx.alienvault.com/pulse/6ab51a43ec94931b637c0607
Pulse Author: AlienVault
Created: 2026-09-24 12:40:35Be advised, this data is unverified and should be considered preliminary. Always do further verification.