Konni

Konni is the least settled label on this site. The name comes from a malware family first reported in 2017, and activity around it has been attributed to a cluster of its own, to Kimsuky, and to a toolset shared by more than one team.

Targets are Korean-peninsula policy work, Russian diplomatic entities and, more recently, developers. Microsoft's current designation, Opal Sleet, is listed alongside both Konni and APT43, though APT43 is also an alias of Kimsuky here. Many sources carry two campaign labels.

Named individuals

None profiled on this site yet

Fabricated personas

None reconstructed under this tag

Indicators

529 in the searchable index

Hunts

None in the hunt library

How it differs from the other clusters here

Delivery is by document: archives with a shortcut or macro-bearing file, a decoy that opens correctly, and a script chain fetching the real payload.

Reporting documents lures disguised as Hangul documents and malware generated with commodity artificial-intelligence tooling.

Staging uses services already allowed, usually a cloud storage provider or developer platform, rather than infrastructure the operator must register.

Compare Lazarus GroupAPT38KimsukyRGB (Reconnaissance General Bureau)Remote Worker Fraud / Contagious InterviewAndarielAPT37Moonstone SleetPolinRider

What a defender would see

Treat a Konni indicator like a Kimsuky one and do not spend effort on the boundary between them.

The generalising parts are archive-with-shortcut delivery, a decoy that opens correctly, and a script host launched from a document directory.

Where a source names both clusters, this site records both labels, so filtering by either returns the shared reporting.

Indicators

The 529 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from

Show 50 more

Further reading

Published research on this cluster. None of it is this site’s work.

• KONNI: MITRE ATT&CK software entry MITRE · 2025-10-21

  Dated to the entry's last modification on ATT&CK.

• How Microsoft names threat actors Microsoft Learn · 2026-08-18

  The source for Opal Sleet's alias row, which lists OSMIUM, Velvet Chollima, Planedown, Konni and APT43 together — the clearest single illustration of how far this boundary problem extends into Microsoft's own taxonomy.

• Vedalia APT Group Exploits Oversized LNK Files to Deliver Malware GBHackers · 2024-04-08

  The dated report behind the Vedalia alias added above, which it states plainly is "also known by its alias Konni." This site could not trace which vendor coined Vedalia first, and Malpedia's Konni entry (credited to the MISP Project) corroborates the name without dating it, so it is listed as documented rather than attributed to a specific naming scheme.