8 minhigh
VelvetCake: Konni Targets Ukraine With Malicious LNK Files
DPRK-aligned Konni targets Ukrainian diplomatic and think tank entities with VelvetCake malware delivered via malicious LNK files and trojanized Zoom installers for intelligence collection. VelvetCake is a modular PowerShell task runner that retrieves and executes server-side scripts via raw TCP C2 on port 12345. A VBScript persistence mechanism creates a scheduled task executing the payload every minute. The campaign also distributes a trojanized Zoom installer with the same components, and a recovered second-stage script performs host enumeration and screen capture.
Sens:▲ 24hConf:high
IOCs30
13sha25611url3domain1email1file path1ip
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block C2 IP 111.92.246.145 and domains on medianewsonline, elementfx, onlinewebshop at perimeter
- Hunt for scheduled task OneDriveUpdateScheduler across all Windows endpoints
- Quarantine hosts with SHA256 hashes matching listed LNK and executable files
- Block access to GitHub account omskiwdcvoiuyfd0998 and associated raw URLs
Key Takeaways
- Campaign active since August 2026 with GitHub commits concentrated in UTC+9 working hours.
- VelvetCake authenticates via raw TCP using password MySecurePass123 on port 12345.
- GitHub account omskiwdcvoiuyfd0998 stages all malicious scripts, lures, and trojanized Zoom installer.
- Scheduled task OneDriveUpdateScheduler uses explorer.exe to run VelvetCake every minute.
- Recovered second-stage script captures screenshots and queries antivirus via WMI SecurityCenter2.
Attack Chain
- Initial Access: Spear-phishing emails deliver ZIP archives with LNK files disguised as PDF documents
- Execution: LNK launches PowerShell downloading update1.vbs and update2.ps1 from GitHub to AppData
- Persistence: VBScript creates scheduled task OneDriveUpdateScheduler executing VelvetCake every minute
- C2: VelvetCake connects via raw TCP to 111.92.246.145:12345 authenticating with hardcoded password
- Discovery: Server-side scripts enumerate system, capture screenshots, and query installed antivirus
- Exfiltration: Data sent via HTTP POST to medianewsonline C2; local artifacts purged
Affected Systems
- Windows systems targeted via LNK and scheduled task persistence
- Users receiving spear-phishing emails with ZIP attachments
- Zoom users targeted with trojanized installer
- Ukrainian diplomatic entities and think tanks
- Non-Governmental Organizations focused on Ukraine policy
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | PowerShell execution and scheduled task creation visible; raw TCP C2 less monitored |
| Network Visibility | High | Raw TCP to non-standard port 12345 and HTTP POST to C2 domains observable |
| Detection Difficulty | Moderate | Uses legitimate GitHub and PowerShell but has distinctive artifacts like hardcoded password |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Scheduled tasks with OneDrive-themed names executing PowerShell every minute via explorer.exe (T1053.005) | Scheduled task logs and process creation events | Persistence | Low — OneDriveUpdateScheduler with one-minute trigger is atypical |
| PowerShell downloading content from raw.githubusercontent.com and executing via Invoke-Expression (T1059.001) | PowerShell script block logs and network connections | Execution | Medium — developers may use GitHub raw URLs legitimately |
| Raw TCP connections to non-standard ports with plaintext password authentication (T1095) | Firewall and network connection logs | Command and Control | Low — TCP to port 12345 with PASSWORD command is distinctive |
| LNK files with PDF extensions launching PowerShell download commands from GitHub (T1204.002) | Process creation with parent LNK and command line | Execution | Low — LNK to PowerShell with download is rare |
Required Log Sources
- PowerShell script block logs (Event ID 4104)
- Process creation logs (Event ID 4688)
- Scheduled task creation logs (Event ID 4698)
- Network connection logs
- Sysmon network connections (Event ID 3)
Key Behavioral Indicators
- Scheduled task OneDriveUpdateScheduler with one-minute trigger executing PowerShell
- Raw TCP to port 12345 with PASSWORD MySecurePass123 authentication
- Explorer.exe spawning PowerShell on recurring one-minute schedule
- PowerShell downloading from raw.githubusercontent.com and invoking via iex
- HTTP POST to medianewsonline with userdomain and username parameters
- UPLOAD command with 0x12345678 header flag in network traffic
Control Gaps
- Network DLP may miss raw TCP exfiltration on non-standard ports
- Email gateways may not detect LNK files inside ZIP attachments
- Application allowlisting may not cover PowerShell and VBScript execution
- Web proxy may allow raw.githubusercontent.com for all users
- Endpoint AV may not flag scheduled tasks with legitimate-sounding names
False Positive Assessment
Low — VelvetCake uses distinctive hardcoded artifacts including password MySecurePass123, specific scheduled task name, and custom TCP protocol with 0x12345678 header flag.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict outbound raw TCP connections to non-standard ports from workstations
- Enable PowerShell script block logging and transcript capture on all endpoints
- Block raw.githubusercontent.com for non-developer systems via web proxy
- Monitor DNS for subdomains on medianewsonline, elementfx, onlinewebshop free hosting
User Protection
- Deploy EDR detection for LNK files launching PowerShell download commands
- Block ZIP attachments containing LNK files in email gateways
- Instruct users to download Zoom only from zoom.us official website
- Enable ASR rules for obfuscated script execution and credential theft
Security Awareness
- Brief targeted staff on spear-phishing using geopolitical peace negotiation lures
- Warn about trojanized Zoom installers distributed via meeting invitations
- Train recipients to verify email sender addresses before opening attachments
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping20 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
North Korean hackers sent fake documents about Ukraine peace negotiations and food prices to trick people into opening them. Opening these files installed a program called VelvetCake that runs every minute, takes screenshots, and sends information back to the hackers. The hackers also created a fake Zoom meeting app installer to spread the same malware. Organizations working on Ukraine policy should check their computers for suspicious scheduled tasks and block the known malicious websites.
Additional IOCs
- Urls:
hxxps://github[.]com/omskiwdcvoiuyfd0998/- Threat actor GitHub account for staginghxxps://github[.]com/omskiwdcvoiuyfd0998/media- GitHub repo hosting peace negotiation lurehxxps://github[.]com/omskiwdcvoiuyfd0998/medianews- GitHub repo hosting sociologist CV lurehxxps://github[.]com/omskiwdcvoiuyfd0998/zoominstaller- GitHub repo hosting trojanized Zoom installerhxxps://github[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh- GitHub repo hosting VelvetCake scriptshxxps://raw[.]githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh/refs/heads/main/LICENSE- URL hosting update1.vbs persistence scripthxxps://raw[.]githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh/refs/heads/main/okay.md- URL hosting update2.ps1 VelvetCake downloaderhxxp://p1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]com/logout.php?OKey=$env:userdomain&Who=$env:username- VelvetCake HTTP exfiltration URLhxxps://kovalenko[.]dothome[.]co[.]kr/media/A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf- Lure document hosted on compromised South Korean sitehxxps://dofamini[.]com[.]ua/media/CV_OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative.pdf- Lure document hosted on compromised Ukrainian site
- File Hashes:
d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a(SHA256) - CV-themed LNK lure fileac8df7baf7f1397a8c194840f6a5c1b0182088febde55f46d9f73ee8abc97c1d(SHA256) - Scheduled task registration VBScripte162d64d3e69cea868f62f63906098de310fad9fa1ca693409a65de89760eaaa(SHA256) - Scheduled task registration VBScript variant9f2cc22a74499b0a5b39a8f4732ff74d7338addd972387302016ba5a026936ac(SHA256) - Scheduled task registration VBScript variantd3e599af47b110ab526ee38edaae68df3d8ab257e689e6f6f84d6db7d3ba5937(SHA256) - Scheduled task registration script (LICENSE file)467660ef31b8ec248ae434fdee0a68de5098bcfd08776a4004ccbdcd7904bd37(SHA256) - VelvetCake first stage payloadc88165d943f59014d668818d99d9819e6d295d355c4e935ad7a2380bbe32ccc4(SHA256) - VelvetCake first stage payload (okay.md)e41fdf41e6f5d089d1b8d7ea6f6a5c76760fe2a553c8ebc47601ebeca01311e1(SHA256) - VelvetCake download URL content hash76e9bdf193b3127623b674efdf3f0e3585932af33c9c85a3d6375d369de0e12a(SHA256) - VelvetCake download URL content hash
- File Paths:
C:\Users\Public- Directory where C2 config files are downloaded%TEMP%- Directory where PowerShell payload scripts are dropped
- Command Lines:
- Purpose: Download VBS and PS1 payloads from GitHub to AppData | Tools:
PowerShell| Stage: Execution |powershell -c (New-Object Net.WebClient).DownloadFile - Purpose: Create scheduled task to execute VelvetCake every minute | Tools:
VBScript,schtasks| Stage: Persistence |schtasks /create /tn OneDriveUpdateScheduler /tr - Purpose: Execute VelvetCake in memory from C2 without disk storage | Tools:
PowerShell,Net.WebClient| Stage: Execution |powershell -c iex (New-Object Net.WebClient).DownloadString - Purpose: Enumerate system info, network config, processes, and antivirus | Tools:
systeminfo,ipconfig,PowerShell| Stage: Discovery |systeminfo; ipconfig /all; Get-Process
- Purpose: Download VBS and PS1 payloads from GitHub to AppData | Tools:
- Other:
OneDriveUpdateScheduler- Scheduled task name used for persistenceMySecurePass123- Hardcoded C2 TCP authentication password12345- Hardcoded C2 TCP port for VelvetCake communication0x12345678- 4-byte header flag prepended to UPLOAD commandsupdate1.vbs- Persistence VBScript downloaded from GitHubupdate2.ps1- VelvetCake PowerShell downloader downloaded from GitHubzoominstaller.exe- Trojanized Zoom installer filenameA_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction.pdf.lnk- LNK filename with double extension masquerading as PDFCV_OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative.lnk- LNK filename for CV-themed lure
Showing defanged values
- domainjaemoolding25863[.]elementfx[.]comVelvetCake C2 domain
- domainp1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]comPrimary VelvetCake HTTP C2 domain
- domainzvwb1ep7i[.]onlinewebshop[.]netVelvetCake C2 domain
- emailomski00[@]outlook[.]comThreat actor email address
- file_pathC:\Users\PublicDirectory where C2 config files are downloaded
- ip111[.]92[.]246[.]145VelvetCake raw TCP C2 on port 12345
- sha2560db1e8a3075ffc2f5caa91abaeabb6ba4365ae0eda64d179374614a79e317733Trojanized Zoom installer delivering VelvetCake
- sha256297292d46d4f11fc801f5d6d01251735698a8419aa3196db7b3aa7bb8ea85cadLNK file disguised as peace architecture PDF
- sha256467660ef31b8ec248ae434fdee0a68de5098bcfd08776a4004ccbdcd7904bd37VelvetCake first stage payload
- sha25676e9bdf193b3127623b674efdf3f0e3585932af33c9c85a3d6375d369de0e12aVelvetCake download URL content hash
- sha2569f2cc22a74499b0a5b39a8f4732ff74d7338addd972387302016ba5a026936acScheduled task registration VBScript variant
- sha256ac8df7baf7f1397a8c194840f6a5c1b0182088febde55f46d9f73ee8abc97c1dScheduled task registration VBScript
- sha256c88165d943f59014d668818d99d9819e6d295d355c4e935ad7a2380bbe32ccc4VelvetCake first stage payload (okay.md)
- sha256cd0a48b5ebd946ea2b8964e9d6a73a48d73777fdb7c8da99c28404150b560f6cPowerShell enumeration and exfiltration script
- sha256d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439aCV-themed LNK lure file
- sha256d3e599af47b110ab526ee38edaae68df3d8ab257e689e6f6f84d6db7d3ba5937Scheduled task registration script (LICENSE file)
- sha256e162d64d3e69cea868f62f63906098de310fad9fa1ca693409a65de89760eaaaScheduled task registration VBScript variant
- sha256e41fdf41e6f5d089d1b8d7ea6f6a5c76760fe2a553c8ebc47601ebeca01311e1VelvetCake download URL content hash
- sha256ec47a2101de4f1fc25995e775ddb48e20977081c4d885e6ff8fdfe9109d05495VelvetCake standalone executable
- urlhxxp://p1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]com/login[.]php?OKey=$env:userdomain&Areyou=cake&Who=$env:usernameC2 check-in URL exfiltrating domain and username
- urlhxxp://p1o2i3u4y5t6r7e8w9q0[.]medianewsonline[.]com/logout[.]php?OKey=$env:userdomain&Who=$env:usernameVelvetCake HTTP exfiltration URL
- urlhxxps://dofamini[.]com[.]ua/media/CV_OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative[.]pdfLure document hosted on compromised Ukrainian site
- urlhxxps://github[.]com/omskiwdcvoiuyfd0998/Threat actor GitHub account for staging
- urlhxxps://github[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefhGitHub repo hosting VelvetCake scripts
- urlhxxps://github[.]com/omskiwdcvoiuyfd0998/mediaGitHub repo hosting peace negotiation lure
- urlhxxps://github[.]com/omskiwdcvoiuyfd0998/medianewsGitHub repo hosting sociologist CV lure
- urlhxxps://github[.]com/omskiwdcvoiuyfd0998/zoominstallerGitHub repo hosting trojanized Zoom installer
- urlhxxps://kovalenko[.]dothome[.]co[.]kr/media/A_Century_Long_Peace_Architecture_for_Russia-Ukraine_Introduction[.]pdfLure document hosted on compromised South Korean site
- urlhxxps://raw[.]githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh/refs/heads/main/LICENSEURL hosting update1.vbs persistence script
- urlhxxps://raw[.]githubusercontent[.]com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh/refs/heads/main/okay[.]mdURL hosting update2.ps1 VelvetCake downloader
Related
- GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign·1
- WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials·1
- Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties·1
Stay currentSubscribe via RSS