The DNSC has identified a phishing campaign in which the North Korean group Konni uses malicious LNK files to infect users via email.

The National Cyber Security Directorate (DNSC) has alerted users to an active phishing campaign attributed to the North Korean group Konni. It uses malicious LNK files attached in emails to infect targeted systems. The malware is downloaded through trusted cloud infrastructures such as Dropbox and Google Drive. Konni, which has been active since 2014, focuses on data exfiltration and has been associated with cyberattacks in South Korea, Russia, the US and Europe, with similar techniques to other state-sponsored groups.