Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
26 IOCs
To Russia With Love: Assessing a KONNI-Backdoored Suspected Russian Consular Software Installer
Threat Actors
Excerpt
Earlier this year, DCSO observed an intriguing malware sample first uploaded to VirusTotal in mid-January 2024 that we believe to be part of North Korea-linked activity targeting the Russian Ministry of Foreign Affairs. The malware itself appears to be KONNI, a North Korea (DPRK) nexus tool believed to have been used since as early as 2014 . The use of KONNI in highly similar activity targeting the Russian Ministry of Foreign Affairs was previously observed by various…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →26 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | p593d8g9.mygamesonline.org | High | Score 58/100 | First seen |
| Domain | 88zr7cua.atwebpages.com | High | Score 58/100 | First seen |
| Domain | mhhnv7s9.myartsonline.com | High | Score 58/100 | First seen |
| Domain | t8nptw2h.mywebcommunity.org | High | Score 58/100 | First seen |
| MD5 | 7f9fad83f4e56c684c11b9fffbd047e8 | Medium | Score 53/100 | First seen |
| Domain | zomfaa9a.onlinewebshop.net | High | Score 58/100 | First seen |
| SHA256 | 58bcd90f6f04c005c892267a3dfe91d1154d064482b07715ad5802f57c1ea32d | Medium | Score 53/100 | First seen |
| Domain | jbkza9h7.atwebpages.com | High | Score 58/100 | First seen |
| Domain | tl2j38w9.mypressonline.com | High | Score 58/100 | First seen |
| Domain | victory-2020.atwebpages.com | High | Score 58/100 | First seen |
| Domain | cor8xcib.getenjoyment.net | High | Score 58/100 | First seen |
| Domain | mbfasq54.mypressonline.com | High | Score 58/100 | First seen |
| SHA256 | 9339eaf1d77bb0324e393a08a6180fe0658761fc0cd20ba25081963286dfb9c7 | Medium | Score 53/100 | First seen |
| Domain | p8tebfel.getenjoyment.net | High | Score 58/100 | First seen |
| Domain | victory-2024.mywebcommunity.org | High | Score 58/100 | First seen |
| Domain | 99695njd.myartsonline.com | High | Score 58/100 | First seen |
| Domain | 3cym4ims.medianewsonline.com | High | Score 58/100 | First seen |
| Domain | w9uzs9la.mywebcommunity.org | High | Score 58/100 | First seen |
| Domain | j1p75639.medianewsonline.com | High | Score 58/100 | First seen |
| Domain | 24ev0apa.scienceontheweb.net | High | Score 58/100 | First seen |
| SHA256 | b60dc12833110098f5eec9a51749d227db7a12d4e91a100a4fd8815695f1093f | Medium | Score 53/100 | First seen |
| Domain | 5s6bqbea.sportsontheweb.net | High | Score 58/100 | First seen |
| Domain | g66nzt8q.mygamesonline.org | High | Score 58/100 | First seen |
| Domain | zcvbm1zv.onlinewebshop.net | High | Score 58/100 | First seen |
| Domain | c6cdg4su.sportsontheweb.net | High | Score 58/100 | First seen |
| Domain | 694qf6w8.scienceontheweb.net | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…