SANC_Nine_KBW_Seoul_Invitation.pdf.lnk
SANC_Nine_KBW_Seoul_Invitation.pdf.lnk is a file name
that one published source reports
in connection with Konni activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Frost (@fr0s7_).
The report is dated 2026-09-29.
filename Konni RESEARCHER POST
Source
-
A self-thread the researcher tags #DPRK #KONNI, describing an invitation to a fake Sanctum and Superteam Korea event during Korea Blockchain Week in Seoul. The LNK runs conhost and PowerShell, carves a decoy PDF and an XOR-encoded payload out of itself, writes the payload to a .err file under C:\ProgramData\Diagnosis and registers a scheduled task that runs a PowerShell backdoor every 30 minutes, falling back to SYSTEM. The backdoor talks to a PHP endpoint on an InfinityFree subdomain and exits if any of 53 analysis tools is running. The four hashes are, in order, the ZIP, the .err payload, the PowerShell script and the decoy PDF, as the thread labels them; the decoy is the lure document itself, not malicious code.
x.com/fr0s7_/status/2104911500259315713 — Frost (@fr0s7_)
Find this indicator in the index, or see every file name this site holds under File names in the browse listing.