fe29jf323.kesug.com
fe29jf323.kesug.com is a hosted site
that 2 published sources report
in connection with Konni activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Frost (@fr0s7_).
The earliest of those reports is dated 2026-09-29 and the most recent 2026-10-15.
hosted site Konni RESEARCHER POST
Sources
-
A self-thread the researcher tags #DPRK #KONNI, describing an invitation to a fake Sanctum and Superteam Korea event during Korea Blockchain Week in Seoul. The LNK runs conhost and PowerShell, carves a decoy PDF and an XOR-encoded payload out of itself, writes the payload to a .err file under C:\ProgramData\Diagnosis and registers a scheduled task that runs a PowerShell backdoor every 30 minutes, falling back to SYSTEM. The backdoor talks to a PHP endpoint on an InfinityFree subdomain and exits if any of 53 analysis tools is running. The four hashes are, in order, the ZIP, the .err payload, the PowerShell script and the decoy PDF, as the thread labels them; the decoy is the lure document itself, not malicious code.
x.com/fr0s7_/status/2104911507943502042 — Frost (@fr0s7_) -
The researcher tags the first post #DPRK #KONNI #C2 and gives a C2 URL ending in the same /YE97Bw999zB87t1U8i.php path as the KBW lure's backdoor of 29 September, then a second on 15 October, then in a reply links the paste he titles KONNI C2, which lists fifteen URLs on that path across seven hosts: four subdomains of InfinityFree's xo.je, two of its kesug.com (fe29jf323.kesug.com is the September backdoor's C2), and one of nfy.fyi. Free-hosting subdomains are filed as hosted sites, the address being the operator's choice of name on a platform that gives one to anyone. Read on 26 October 2026; the first post shows one reply, which is @skocherhan's image-only reply in the same chain and carries no value. The paste was set to expire in November 2026.
pastes.io/JM2VHZhY — Frost (@fr0s7_)
Find this indicator in the index, or see every hosted site this site holds under Hosted sites in the browse listing.