North KoreaAssessedDPRK state-sponsoredEspionageActive 2014 – 2026Konni
Also known asOpal Sleet · OSMIUM · TA406 · NICKEL JUNIPER
Summary
North Korea-aligned espionage group named after its KONNI remote-access trojan and active since at least 2014. Microsoft tracks it as Opal Sleet (formerly OSMIUM), Proofpoint as TA406 and Sophos CTU as NICKEL JUNIPER. It is best known for spear-phishing South Korean diplomatic, government, NGO and academic targets with lures themed on the Korean Peninsula, and has long targeted Russian government entities. Its delivery chains favour HTML and CHM files that run embedded PowerShell (T1218.001, T1059.001), password-protected archives fetched from file-hosting links (T1566.002), and scheduled tasks for persistence (T1053.005). From February 2025 Proofpoint saw it phish Ukrainian government entities with fake Microsoft security alerts and malware lures, probably to gauge the course of the war after North Korea sent troops to Russia. In January 2026 Check Point reported an ongoing campaign against blockchain developers and engineering teams in Japan, Australia and India, using LNK-launched loaders, an AI-written PowerShell backdoor and the SimpleHelp RMM tool (T1219). Its relationship to Kimsuky is unsettled: Microsoft and Proofpoint track it separately from Emerald Sleet / TA427, Sophos sees overlaps with Kimsuky and ScarCruft, CrowdStrike folds it into its VELVET CHOLLIMA umbrella, and MITRE notes some evidence linking the KONNI malware to APT37. Microsoft also lists APT43 under Opal Sleet; that name stays on Kimsuky, where Mandiant, which coined it, and MITRE place it.
Attribution
Vendor assessments (Proofpoint, Sophos CTU, Check Point); no government attribution on record
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Proofpoint (Research, 2025-05-13)
A DPRK state-sponsored actor (as TA406) - Sophos CTU (Research, 2026-10)
Espionage on behalf of the North Korean government (moderate confidence)
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Blockchain developers in Japan, Australia and India — AI-written PowerShell backdoor | 2025-10 – ongoing | Japan, Australia, India | Technology, Cryptocurrency | Check Point Research (2026-01-22) — "an ongoing phishing campaign"; earlier variants on VirusTotal from October 2025; ongoing at publication; victim countries inferred by Check Point from VirusTotal submitters |
| Ukrainian government phishing — fake Microsoft security alerts and HTML/CHM PowerShell lures (as TA406) | 2025-02 – 2025-05 | Ukraine | Government | Proofpoint (2025-05-13) — end is the publication month |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 6
| Initial Access1 | T1566.002Spearphishing Link |
|---|---|
| Execution3 | T1059.001PowerShellT1053.005Scheduled TaskT1204.002Malicious File |
| Stealth1 | T1218.001Compiled HTML File |
| Command and Control1 | T1219Remote Access Tools |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| KONNI | RAT | Windows |
| SimpleHelp | Legitimate RMM tool (abused) | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2023-38831 | 7.8 | WinRAR — code execution via crafted archive (KEV 2023-08-24) |
Highest CVSS first.
Infrastructure patterns
- Freemail senders spoofing think-tank staff; MEGA-hosted, password-protected RAR lures (Proofpoint, 2025)
- Discord-hosted links delivering a ZIP with a PDF lure and an LNK loader (Check Point, 2026)
Reporting and advisories 4
- Proofpoint
TA406 pivots to the front (May 2025) - Check Point Research
KONNI adopts AI to generate PowerShell backdoors (Jan 2026) - MITRE ATT&CK
KONNI (S0356) - Sophos CTU
NICKEL JUNIPER threat profile