North Korea-Linked Konni APT Exploits Android and Windows Devices via Google Find Hub

In September 2025, cybersecurity researchers from Genians Security Center (GSC) uncovered a sophisticated campaign by the North Korea-linked Konni APT group, also known as Kimsuky, Earth Imp, TA406, Thallium, Vedalia, and Velvet Chollima. This group, notorious for highly targeted cyberattacks, posed as counselors and activists to compromise Android and Windows devices, steal sensitive data, and even remotely wipe phones using Google’s Find Hub service. The operation highlights the increasing complexity and audacity of state-sponsored cyber threats.

the Konni APT Campaign

The Konni Remote Access Trojan (RAT) was first identified by Cisco Talos in 2017 but had remained largely undetected since 2014 due to its adaptive and evasive capabilities. This RAT allows attackers to execute arbitrary code on victim systems, steal information, and maintain prolonged access without detection. Researchers attribute the RAT to North Korea-affiliated actors, including Thallium and APT37.

According to the GSC report, the attackers impersonated psychological counselors and North Korean human rights activists, distributing malware disguised as stress-relief programs. The malicious files were delivered primarily through KakaoTalk, exploiting trust relationships between acquaintances. Notably, the campaign leveraged Google’s Find Hub service to remotely reset Android devices, erasing personal data and tracking victim locations—a first for state-sponsored APT operations.

The attack chain began with spear-phishing emails masquerading as the South Korean National Tax Service. Targets included counselors assisting North Korean defectors. Once devices were compromised, the attackers used them to propagate malware via victims’ KakaoTalk accounts. When victims were away, attackers remotely wiped Android phones and tablets, combining stealth and destructive tactics.

The malware distribution relied on files like “Stress Clear.zip,” containing MSI installers disguised as legitimate applications. These installers executed silently on Windows systems, deploying additional RATs such as Lilith, RemcosRAT, QuasarRAT, and RftRAT, all connected to command-and-control servers in Russia, Japan, and the Netherlands. The campaign involved multi-layer relays, evasion techniques, and staged infrastructure on WordPress sites to avoid detection.

Without behavior-based detection tools such as Endpoint Detection and Response (EDR), the attackers could persist on infected systems, harvesting data, conducting covert surveillance, and executing further attacks over extended periods. Logs and artifacts, including folders labeled “Attack Weapon,” revealed a highly organized malware development and deployment framework. The report also provides detailed Indicators of Compromise (IoCs) for cybersecurity teams to detect and mitigate similar threats.

What Undercode Say:

The Konni APT campaign demonstrates a concerning evolution in state-sponsored cyberattacks. Unlike conventional malware operations, this campaign blends social engineering, psychological manipulation, and advanced technical exploitation to achieve multiple objectives: data theft, device control, and mass data destruction. By impersonating counselors and human rights activists, the attackers exploited human trust—a reminder that cybersecurity defenses must address both technical vulnerabilities and human factors.

The use of Google Find Hub for remote wipes is particularly alarming. Traditionally, such device management tools are seen as security features, but here they were weaponized for state-sponsored attacks. This sets a dangerous precedent: any cloud-based management or “find my device” service could potentially be exploited by sophisticated adversaries if account credentials are compromised.

Moreover, the campaign highlights the multi-platform threat landscape. While the MSI installer primarily targeted Windows systems, the attackers’ ability to leverage Android devices via Google services shows how cross-platform attacks are becoming increasingly feasible. Combining email phishing, messaging app propagation, and cloud service exploitation demonstrates an advanced, multi-vector attack chain that is difficult to detect without comprehensive monitoring.

The persistence and stealth of the Konni RAT underline the importance of proactive endpoint security. Behavior-based detection, anomaly monitoring, and strict account management can mitigate such threats. Organizations dealing with sensitive populations—like North Korean defectors—are especially vulnerable, making operational awareness and cybersecurity hygiene critical.

This attack also illustrates the sophistication of state-backed cyber operations. By leveraging multiple RATs, evasion techniques, and international C2 infrastructure, the Konni group demonstrates a capacity for long-term surveillance, data exfiltration, and potential geopolitical impact. The careful planning, including staged WordPress sites and layered malware deployment, indicates that future attacks will likely continue to blend digital espionage with real-world social engineering.

Finally, this campaign underscores the increasing need for collaboration between cybersecurity researchers, cloud providers, and messaging platforms. Quick detection, IoC sharing, and user education are vital to counter the rapid evolution of threats like Konni. As attackers exploit both technology and trust, defending against such multi-dimensional campaigns requires equally multi-faceted strategies.

Fact Checker Results:

✅ Konni APT group linked to North Korea – confirmed by multiple cybersecurity reports.
✅ Malware used Google Find Hub to remotely wipe Android devices – verified in GSC analysis.
❌ There is no evidence that all victims’ devices were infected globally; attacks were highly targeted.

Prediction 📊

The weaponization of cloud-based device management tools like Google Find Hub will likely inspire similar attacks in the future. Threat actors may increasingly combine social engineering with remote administration features to bypass traditional defenses. Organizations should anticipate multi-platform campaigns leveraging both mobile and desktop environments. As geopolitical tensions rise, state-sponsored APT groups like Konni may continue refining their tactics, emphasizing stealth, data exfiltration, and destructive capabilities, potentially extending their campaigns beyond South Korea to other vulnerable regions.