KONNI
Software · ATTACK:enterprise:S0356
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0356",
"title": "KONNI",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0356",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--86b92f6c-9c05-4c51-b361-4c7bb13e21a1",
"external_id": "S0356",
"domain": "enterprise",
"created": "2019-01-31T00:36:39.771Z",
"modified": "2025-10-21T03:20:18.481Z",
"version": "2.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "KONNI"
},
{
"source_name": "Unit 42 Nokki Oct 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"
},
{
"source_name": "Unit 42 NOKKI Sept 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"
},
{
"source_name": "Medium KONNI Jan 2020",
"url": "https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"
},
{
"source_name": "Talos Konni May 2017",
"url": "https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"
},
{
"source_name": "Malwarebytes Konni Aug 2021",
"url": "https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"
}
]
}Explicit source assertions (40)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06f8a778-eebf-4d73-86d3-6ebdbf94ce46
Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0baf5506-35fb-4508-ba9a-09ca2962df43
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--172da5b1-cf68-468a-8208-b15ea5c813dc
Medium KONNI Jan 2020 · Talos Konni May 2017 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1546.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cc6adf5-a09d-4878-b816-22af0770d3c1
Medium KONNI Jan 2020ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2251e15a-5b62-408d-b6a0-01aa8e2677b3
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27c397ca-aaa1-4cf5-b663-bde9b82050a6
Medium KONNI Jan 2020ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28fd47e4-d76e-4cd2-8ad2-745d1d0a5c72
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29403801-cdba-4de9-9b9c-c1295b9eccf6
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b2e0b6e-10ac-42c0-8d77-3ffc9cc654a7
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1134.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3231ef46-26f9-4711-adfe-cfa68425f848
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--347b7512-1e76-456f-9f04-0179d056ca9a
Malwarebytes KONNI Evolves Jan 2022ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36a0199f-bce6-4717-a4e4-ce3d75a7ab1c
Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37b3a79f-6f48-4c5c-9ec7-b063ad375083
Talos Konni May 2017 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--412c7c8b-4821-4f08-a3d2-2da034f8343f
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--432f7a25-5994-4f50-8b75-c62c674f27a7
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--475d30ee-999c-470c-b4b3-eed40d1db799
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49df789a-5d6c-4820-af9f-7c4484531680
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--592df85b-8f0b-46c1-87e6-fa48da9c0ead
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b530bcc-d137-4b4c-a22f-a3c15ec2f101
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--726cd7e2-d545-4ddf-8f86-fe1cab083dae
Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7425e191-ec5c-40ec-ab5f-fb99d6064422
Talos Konni May 2017 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7431e309-f379-45a5-ae7d-0520f6b17a94
Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b30e00a-71c6-4ad8-b2a8-39f000156930
Medium KONNI Jan 2020 · Talos Konni May 2017 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--823fc0fa-1648-40ed-87a3-eec3138eb3dd
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8720f2bc-c099-4d2c-a9b4-faf019bf55a4
Talos Konni May 2017 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9187cbc8-c0b5-440b-b10a-226684e968fc
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92671dd1-74a4-4bf4-8a04-6577674614d8
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9dffc323-ae0a-430e-b9de-e059862432a1
Medium KONNI Jan 2020ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af7323ae-bb42-49fd-9c8d-218a1335f662
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afb593c0-5388-441c-a868-c8bc520ffcaa
Medium KONNI Jan 2020 · Talos Konni May 2017 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b23e8d31-bb6a-42b4-ab34-1c9e302a3b74
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5c85267-6a3e-4254-a851-3529f4f80b55
Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1134.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf5b088a-6d58-41ce-b36d-ff911fe76fb8
Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6761f22-a8ed-4a9a-8d58-e8eee38ead88
Talos Konni May 2017 · Malwarebytes KONNI Evolves Jan 2022 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce43264e-ab32-45a7-898f-0320c477c581
Malwarebytes KONNI Evolves Jan 2022ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4c9b3cb-44ca-47be-b10f-2371ef1c23df
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1547.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e57361ca-1d03-4171-86e2-09f8c32cb319
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e77c6605-41e9-470f-80fc-2a383aeccc5e
Talos Konni May 2017ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb17d12e-721b-4ebb-a4ff-8fe62a3189ca
Malwarebytes Konni Aug 2021ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4f3a2bc-d359-400e-8b1e-95d71a20c323
Talos Konni May 2017