{
 "slug": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
 "title": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
 "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026",
 "json": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "active",
 "verification": "verified",
 "ai": {
  "role": "ai-malware",
  "note": "Check Point Research describes the payload as an AI-generated PowerShell backdoor."
 },
 "chains": [
  "multi-evm"
 ],
 "method": "social-engineering",
 "product": "Blockchain and crypto developers and engineering teams (Asia-Pacific)",
 "tags": [
  "multi-evm",
  "social-engineering",
  "dprk",
  "konni",
  "powershell",
  "backdoor",
  "ai-generated-code",
  "blockchain-developers",
  "phishing",
  "check-point",
  "ai"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-01-22",
 "closedAt": "2026-01-22",
 "updatedAt": "2026-01-22T12:00:00Z",
 "summary": "Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported.",
 "timeline": [
  {
   "date": "2026-01-22",
   "title": "Check Point Research published its findings on KONNI's AI-generated backdoor aimed at blockchain developers.",
   "sourceUrl": "https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "AI-Powered North Korean Konni Malware Targets Developers",
   "url": "https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/",
   "publisher": "Check Point",
   "date": "2026-01-22"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you work on a blockchain or crypto project and opened project documents or archives from an unexpected email or chat, ask your security team to check that machine for unknown scheduled tasks and PowerShell activity.\n\n## What to do now\n- Isolate any machine that ran the lure, then rotate repository, cloud and signing keys from a clean device.\n- Move any wallet funds whose keys were on that machine.\n\n## How to avoid this\n- Treat development machines as high-value targets: no hot wallets or production keys on them.\n- Confirm unexpected documents with the sender on a second channel before opening them.\n- AI lets attackers rewrite malware quickly, so rely on behaviour-based protection, not just signatures.",
 "notes": null,
 "agentBrief": "# North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor\n\n- Severity: Medium · Status: Still active (past)\n- Chains: Multiple EVM chains · Method: Social engineering and fake support\n- Started: Jan 22, 2026 · Last update: Jan 22, 2026\n- Who/what: Blockchain and crypto developers and engineering teams (Asia-Pacific)\n- AI involvement: AI-built malware. Check Point Research describes the payload as an AI-generated PowerShell backdoor.\n\nCheck Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported.\n\n## Am I affected?\nIf you work on a blockchain or crypto project and opened project documents or archives from an unexpected email or chat, ask your security team to check that machine for unknown scheduled tasks and PowerShell activity.\n\n## What to do now\n- Isolate any machine that ran the lure, then rotate repository, cloud and signing keys from a clean device.\n- Move any wallet funds whose keys were on that machine.\n\n## How to avoid this\n- Treat development machines as high-value targets: no hot wallets or production keys on them.\n- Confirm unexpected documents with the sender on a second channel before opening them.\n- AI lets attackers rewrite malware quickly, so rely on behaviour-based protection, not just signatures.\n\n## Sources\n- AI-Powered North Korean Konni Malware Targets Developers (Check Point, 2026-01-22): https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/\n\nFull record: https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026 · JSON: https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}