216.73.217.22

KONNI

· Published 21/12/2025 01:41 · Modified 22/01/2026 21:32 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 01:41
Modified
22/01/2026 21:32
Updated at
22/01/2026 21:32
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
3 reports, 48 attack patterns (mitre), 6 malware, 3 sectors, 4 countries, 85 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (3)

Attack patterns (MITRE) (48)

  • T1574 uses
    Hijack Execution Flow
  • T1547 uses
    Boot or Logon Autostart Execution
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1012 uses
    Query Registry
  • T1573.001 uses
    Symmetric Cryptography
  • T1036.004 uses
    Masquerade Task or Service
  • T1071.001 uses
    Web Protocols
  • T1566 uses
    Phishing
  • T1584 uses
    Compromise Infrastructure
  • T1497 uses
    Virtualization/Sandbox Evasion
  • T1218.011 uses
    Rundll32
  • T1218 uses
    System Binary Proxy Execution
  • T1083 uses
    File and Directory Discovery
  • T1053.005 uses
    Scheduled Task
  • T1112 uses
    Modify Registry
  • T1132.001 uses
    Standard Encoding
  • T1588.001 uses
    Malware
  • T1583 uses
    Acquire Infrastructure
  • T1573 uses
    Encrypted Channel
  • T1102 uses
    Web Service
  • T1057 uses
    Process Discovery
  • T1105 uses
    Ingress Tool Transfer
  • T1548 uses
    Abuse Elevation Control Mechanism
  • T1059.001 uses
    PowerShell
  • T1588.002 uses
    Tool
  • T1078 uses
    Valid Accounts
  • T1571 uses
    Non-Standard Port
  • T1543 uses
    Create or Modify System Process
  • T1033 uses
    System Owner/User Discovery
  • T1059 uses
    Command and Scripting Interpreter
  • T1497.001 uses
    System Checks
  • T1059.005 uses
    Visual Basic
  • T1036 uses
    Masquerading
  • T1027 uses
    Obfuscated Files or Information
  • T1569 uses
    System Services
  • T1055 uses
    Process Injection
  • T1070.004 uses
    File Deletion
  • T1016 uses
    System Network Configuration Discovery
  • T1204.002 uses
    Malicious File
  • T1204 uses
    User Execution
  • T1560 uses
    Archive Collected Data
  • T1082 uses
    System Information Discovery
  • T1134 uses
    Access Token Manipulation
  • T1137 uses
    Office Application Startup
  • T1547.001 uses
    Registry Run Keys / Startup Folder
  • T1049 uses
    System Network Connections Discovery
  • T1497.003 uses
    Time Based Checks
  • T1059.003 uses
    Windows Command Shell

Malware (6)

  • EndRAT uses
    Family
    Published 18/03/2026 10:49 · Modified 18/03/2026 10:49
  • RftRAT uses
    Family
    Published 18/03/2026 10:49 · Modified 18/03/2026 10:49
  • LilithRAT uses
    Family
    Published 10/11/2025 11:14 · Modified 10/11/2025 11:14
  • RemcosRAT uses
    Family
    Published 22/04/2026 07:06 · Modified 22/04/2026 07:06
  • QuasarRAT uses
    Family
    Published 25/02/2026 11:35 · Modified 25/02/2026 11:35
  • AutoItRAT uses
    Family
    Published 18/01/2026 18:38 · Modified 18/01/2026 18:38

Sectors (3)

  • Government targets
  • Technology targets
  • Finance targets

Countries (4)

  • British Indian Ocean Territory targets
  • Japan targets
  • Australia targets
  • India targets

Indicators (85)