Upgrade to Pro

  • State of ArchViz Webinar: How AI Is Changing Architectural Visualization
    The world of architectural visualization is evolving rapidly, driven by new technologies and shifting industry demands.
    To capture the latest trends, Architizer and Chaos surveyed more than 1,000 design professionals worldwide, uncovering key insights into the challenges and opportunities shaping the field.
    The results are now available in the free-to-download State of Architectural Visualization 2024-25 Report — a must-read for architects, designers, and visualization specialists looking to stay ahead of the curve.
    In an engaging webinar hosted by Architizer and Chaos, Roderick Bates, Director of Corporate Development at Chaos, took to our virtual stage to explore the findings of the 2024-25 survey and report — and what they mean for the future of architectural visualization.
    Read on to discover the key points from Bates’ captivating presentation.
    Your browser does not support this, try viewing it on YouTube: YOUR URL
    Shifting Demographics and Global Reach
    Bates began by highlighting the wide-reaching, diverse nature of the survey respondents, which helps to substantiate and increase confidence in the findings.
    This year’s survey reflected a wider range of voices than ever before, with participants hailing from more than 75 countries.
    While 40% were U.S.-based, there was a significant increase in participation from the EU, UK, Oceania, and Asia.
    Firm size varied as well, with 64% of responses coming from small firms with fewer than 20 employees juxtaposed with a healthy 14% representation from firms with 100+ employees.
    “This kind of spread means that the data speaks to everyone in the AEC industry — from freelancers to global studios,” Bates emphasized.
    “All those different stakeholders have different needs, and the survey helps us understand them.”
    Chaos and Architizer’s annual industry reports include “The Future of Architectural Visualization” (2023), “The State of AI in Architecture” (2024), and “The State of Architectural Visualization” (2024-2025).
    Download the latest report for free here.
    Bates emphasized that this year’s survey data has already shaped real-world strategy for Chaos: “This is information that’s incredibly valuable to us as a company when we think about what products to develop — large-scale initiatives, M&A, and more.” The report has been used in internal product roadmaps and even supported due diligence in recent acquisitions.
    Acceleration and Specialization in AI
    AI emerged as a central theme in both the report and the webinar — a fact that should come as no surprise given the rapid emergence of this technology in recent years.
    According to the data, 56% of respondents are now actively using AI tools in their workflows, up dramatically from last year’s insights into AI across the industry.
    35% are using AI to generate quick variations, while 44% are generating concept images and ideas early in design.
    These numbers appear to show that a “maturing” process is underway when it comes to AI usage within architecture.
    “People are no longer AI-hesitant,” Bates said.
    “We’re seeing a lot of firms experimenting with it, and the number of people fully invested — who say it’s part of their workflow — is growing.”
    Chaos recently acquired EvolveLAB and is developing integrated AI tools for its suite of architectural visualization applications.
    Roderick’s webinar demonstrated a range of potential applications for AI, including this animated construction timelapse.
    Chaos’s response to this evolving landscape is characteristically dynamic — they have already developed and launched tailor-made AI tools like the AI Enhancer in Enscape, which can instantly improve the realism of renderings, and have acquired EvolveLAB, which creates high-quality AI-driven tools for visualization, modeling and project documentation.
    “These aren’t generic solutions anymore,” commented Bates.
    “These are tools trained on architectural datasets, made specifically for architectural visualization.”
    Benefits of AI cited in the survey included faster workflows, enhanced creativity, and lower costs — “this sounds like a CFO’s dream right here”, remarked Bates.
    He went on to present examples of AI in action, from a sketch being transformed into a rendering, to instant material variations for a contemporary interior.
    Standardization, Integration, and the Path Forward
    The webinar also tackled some of the biggest roadblocks identified in the report: integration friction, lack of standardization, and concerns around quality control.
    “Architectural firms thrive on consistency,” said Bates, “and AI’s variability can be a headache.”
    To address this, Chaos is building standardized prompt libraries and working toward seamless integration across its visualization tools.
    “You shouldn’t have to redo work,” Bates emphasized.
    “If you’re in our ecosystem — or bringing in data from other platforms — it should just work.”
    Additionally, sustainability was highlighted as another challenging yet high-potential area within visualization workflows, based on survey feedback.
    As Bates explained, tools like Enscape Impact now offer rapid building performance simulations integrated directly into the design environment, requiring just a small number of key inputs.
    “It almost gets to the level of an AI prompt,” he noted.
    Architects are seeking even more automation and ease of use within this niche, signaling a strong demand for sustainability tools that are faster, smarter, and more intuitive — underscoring a major opportunity for future innovation.
    The webinar concluded with a lively Q&A, with AI predictably at the center of the debate.
    Some viewers expressed apprehension around the rapid adoption of these tools, while others pointed to the promise of AI’s efficiencies, freeing them up to focus more on design ideation.
    Whichever side of the argument you land on currently, one thing is certain — the State of Architectural Visualization report provides an invaluable source of insight into the industry today — and where it is heading tomorrow.
    To learn more and download your free copy of the report, click here, and learn more about Chaos’s latest developments in architectural visualization here.
    The post State of ArchViz Webinar: How AI Is Changing Architectural Visualization appeared first on Journal.
    Source: https://architizer.com/blog/inspiration/industry/state-of-architectural-visualization-webinar-chaos/" style="color: #0066cc;">https://architizer.com/blog/inspiration/industry/state-of-architectural-visualization-webinar-chaos/
    #state #archviz #webinar #how #changing #architectural #visualization
    State of ArchViz Webinar: How AI Is Changing Architectural Visualization
    The world of architectural visualization is evolving rapidly, driven by new technologies and shifting industry demands. To capture the latest trends, Architizer and Chaos surveyed more than 1,000 design professionals worldwide, uncovering key insights into the challenges and opportunities shaping the field. The results are now available in the free-to-download State of Architectural Visualization 2024-25 Report — a must-read for architects, designers, and visualization specialists looking to stay ahead of the curve. In an engaging webinar hosted by Architizer and Chaos, Roderick Bates, Director of Corporate Development at Chaos, took to our virtual stage to explore the findings of the 2024-25 survey and report — and what they mean for the future of architectural visualization. Read on to discover the key points from Bates’ captivating presentation. Your browser does not support this, try viewing it on YouTube: YOUR URL Shifting Demographics and Global Reach Bates began by highlighting the wide-reaching, diverse nature of the survey respondents, which helps to substantiate and increase confidence in the findings. This year’s survey reflected a wider range of voices than ever before, with participants hailing from more than 75 countries. While 40% were U.S.-based, there was a significant increase in participation from the EU, UK, Oceania, and Asia. Firm size varied as well, with 64% of responses coming from small firms with fewer than 20 employees juxtaposed with a healthy 14% representation from firms with 100+ employees. “This kind of spread means that the data speaks to everyone in the AEC industry — from freelancers to global studios,” Bates emphasized. “All those different stakeholders have different needs, and the survey helps us understand them.” Chaos and Architizer’s annual industry reports include “The Future of Architectural Visualization” (2023), “The State of AI in Architecture” (2024), and “The State of Architectural Visualization” (2024-2025). Download the latest report for free here. Bates emphasized that this year’s survey data has already shaped real-world strategy for Chaos: “This is information that’s incredibly valuable to us as a company when we think about what products to develop — large-scale initiatives, M&A, and more.” The report has been used in internal product roadmaps and even supported due diligence in recent acquisitions. Acceleration and Specialization in AI AI emerged as a central theme in both the report and the webinar — a fact that should come as no surprise given the rapid emergence of this technology in recent years. According to the data, 56% of respondents are now actively using AI tools in their workflows, up dramatically from last year’s insights into AI across the industry. 35% are using AI to generate quick variations, while 44% are generating concept images and ideas early in design. These numbers appear to show that a “maturing” process is underway when it comes to AI usage within architecture. “People are no longer AI-hesitant,” Bates said. “We’re seeing a lot of firms experimenting with it, and the number of people fully invested — who say it’s part of their workflow — is growing.” Chaos recently acquired EvolveLAB and is developing integrated AI tools for its suite of architectural visualization applications. Roderick’s webinar demonstrated a range of potential applications for AI, including this animated construction timelapse. Chaos’s response to this evolving landscape is characteristically dynamic — they have already developed and launched tailor-made AI tools like the AI Enhancer in Enscape, which can instantly improve the realism of renderings, and have acquired EvolveLAB, which creates high-quality AI-driven tools for visualization, modeling and project documentation. “These aren’t generic solutions anymore,” commented Bates. “These are tools trained on architectural datasets, made specifically for architectural visualization.” Benefits of AI cited in the survey included faster workflows, enhanced creativity, and lower costs — “this sounds like a CFO’s dream right here”, remarked Bates. He went on to present examples of AI in action, from a sketch being transformed into a rendering, to instant material variations for a contemporary interior. Standardization, Integration, and the Path Forward The webinar also tackled some of the biggest roadblocks identified in the report: integration friction, lack of standardization, and concerns around quality control. “Architectural firms thrive on consistency,” said Bates, “and AI’s variability can be a headache.” To address this, Chaos is building standardized prompt libraries and working toward seamless integration across its visualization tools. “You shouldn’t have to redo work,” Bates emphasized. “If you’re in our ecosystem — or bringing in data from other platforms — it should just work.” Additionally, sustainability was highlighted as another challenging yet high-potential area within visualization workflows, based on survey feedback. As Bates explained, tools like Enscape Impact now offer rapid building performance simulations integrated directly into the design environment, requiring just a small number of key inputs. “It almost gets to the level of an AI prompt,” he noted. Architects are seeking even more automation and ease of use within this niche, signaling a strong demand for sustainability tools that are faster, smarter, and more intuitive — underscoring a major opportunity for future innovation. The webinar concluded with a lively Q&A, with AI predictably at the center of the debate. Some viewers expressed apprehension around the rapid adoption of these tools, while others pointed to the promise of AI’s efficiencies, freeing them up to focus more on design ideation. Whichever side of the argument you land on currently, one thing is certain — the State of Architectural Visualization report provides an invaluable source of insight into the industry today — and where it is heading tomorrow. To learn more and download your free copy of the report, click here, and learn more about Chaos’s latest developments in architectural visualization here. The post State of ArchViz Webinar: How AI Is Changing Architectural Visualization appeared first on Journal. Source: https://architizer.com/blog/inspiration/industry/state-of-architectural-visualization-webinar-chaos/ #state #archviz #webinar #how #changing #architectural #visualization
    ARCHITIZER.COM
    State of ArchViz Webinar: How AI Is Changing Architectural Visualization
    The world of architectural visualization is evolving rapidly, driven by new technologies and shifting industry demands. To capture the latest trends, Architizer and Chaos surveyed more than 1,000 design professionals worldwide, uncovering key insights into the challenges and opportunities shaping the field. The results are now available in the free-to-download State of Architectural Visualization 2024-25 Report — a must-read for architects, designers, and visualization specialists looking to stay ahead of the curve. In an engaging webinar hosted by Architizer and Chaos, Roderick Bates, Director of Corporate Development at Chaos, took to our virtual stage to explore the findings of the 2024-25 survey and report — and what they mean for the future of architectural visualization. Read on to discover the key points from Bates’ captivating presentation. Your browser does not support this, try viewing it on YouTube: YOUR URL Shifting Demographics and Global Reach Bates began by highlighting the wide-reaching, diverse nature of the survey respondents, which helps to substantiate and increase confidence in the findings. This year’s survey reflected a wider range of voices than ever before, with participants hailing from more than 75 countries. While 40% were U.S.-based, there was a significant increase in participation from the EU, UK, Oceania, and Asia. Firm size varied as well, with 64% of responses coming from small firms with fewer than 20 employees juxtaposed with a healthy 14% representation from firms with 100+ employees. “This kind of spread means that the data speaks to everyone in the AEC industry — from freelancers to global studios,” Bates emphasized. “All those different stakeholders have different needs, and the survey helps us understand them.” Chaos and Architizer’s annual industry reports include “The Future of Architectural Visualization” (2023), “The State of AI in Architecture” (2024), and “The State of Architectural Visualization” (2024-2025). Download the latest report for free here. Bates emphasized that this year’s survey data has already shaped real-world strategy for Chaos: “This is information that’s incredibly valuable to us as a company when we think about what products to develop — large-scale initiatives, M&A, and more.” The report has been used in internal product roadmaps and even supported due diligence in recent acquisitions. Acceleration and Specialization in AI AI emerged as a central theme in both the report and the webinar — a fact that should come as no surprise given the rapid emergence of this technology in recent years. According to the data, 56% of respondents are now actively using AI tools in their workflows, up dramatically from last year’s insights into AI across the industry. 35% are using AI to generate quick variations, while 44% are generating concept images and ideas early in design. These numbers appear to show that a “maturing” process is underway when it comes to AI usage within architecture. “People are no longer AI-hesitant,” Bates said. “We’re seeing a lot of firms experimenting with it, and the number of people fully invested — who say it’s part of their workflow — is growing.” Chaos recently acquired EvolveLAB and is developing integrated AI tools for its suite of architectural visualization applications. Roderick’s webinar demonstrated a range of potential applications for AI, including this animated construction timelapse. Chaos’s response to this evolving landscape is characteristically dynamic — they have already developed and launched tailor-made AI tools like the AI Enhancer in Enscape, which can instantly improve the realism of renderings, and have acquired EvolveLAB, which creates high-quality AI-driven tools for visualization, modeling and project documentation. “These aren’t generic solutions anymore,” commented Bates. “These are tools trained on architectural datasets, made specifically for architectural visualization.” Benefits of AI cited in the survey included faster workflows, enhanced creativity, and lower costs — “this sounds like a CFO’s dream right here”, remarked Bates. He went on to present examples of AI in action, from a sketch being transformed into a rendering, to instant material variations for a contemporary interior. Standardization, Integration, and the Path Forward The webinar also tackled some of the biggest roadblocks identified in the report: integration friction, lack of standardization, and concerns around quality control. “Architectural firms thrive on consistency,” said Bates, “and AI’s variability can be a headache.” To address this, Chaos is building standardized prompt libraries and working toward seamless integration across its visualization tools. “You shouldn’t have to redo work,” Bates emphasized. “If you’re in our ecosystem — or bringing in data from other platforms — it should just work.” Additionally, sustainability was highlighted as another challenging yet high-potential area within visualization workflows, based on survey feedback. As Bates explained, tools like Enscape Impact now offer rapid building performance simulations integrated directly into the design environment, requiring just a small number of key inputs. “It almost gets to the level of an AI prompt,” he noted. Architects are seeking even more automation and ease of use within this niche, signaling a strong demand for sustainability tools that are faster, smarter, and more intuitive — underscoring a major opportunity for future innovation. The webinar concluded with a lively Q&A, with AI predictably at the center of the debate. Some viewers expressed apprehension around the rapid adoption of these tools, while others pointed to the promise of AI’s efficiencies, freeing them up to focus more on design ideation. Whichever side of the argument you land on currently, one thing is certain — the State of Architectural Visualization report provides an invaluable source of insight into the industry today — and where it is heading tomorrow. To learn more and download your free copy of the report, click here, and learn more about Chaos’s latest developments in architectural visualization here. The post State of ArchViz Webinar: How AI Is Changing Architectural Visualization appeared first on Journal.
    ·51 Views
  • How to Use Apple Maps on the Web
    Apple’s mapping platform is no longer exclusively for Apple devices.
    A pared-down version runs in your browser; here’s how to use it.
    Source: https://www.wired.com/story/how-to-use-apple-maps-on-the-web/" style="color: #0066cc;">https://www.wired.com/story/how-to-use-apple-maps-on-the-web/
    #how #use #apple #maps #the #web
    How to Use Apple Maps on the Web
    Apple’s mapping platform is no longer exclusively for Apple devices. A pared-down version runs in your browser; here’s how to use it. Source: https://www.wired.com/story/how-to-use-apple-maps-on-the-web/ #how #use #apple #maps #the #web
    WWW.WIRED.COM
    How to Use Apple Maps on the Web
    Apple’s mapping platform is no longer exclusively for Apple devices. A pared-down version runs in your browser; here’s how to use it.
    ·12 Views
  • North Korean Konni APT Targets Ukraine with Malware to track Russian Invasion Progress






    May 13, 2025Ravie LakshmananCyber Espionage / Malware

    The North Korea-linked threat actor known as Konni APT has been attributed to a phishing campaign targeting government entities in Ukraine, indicating the threat actor's targeting beyond Russia.
    Enterprise security firm Proofpoint said the end goal of the campaign is to collect intelligence on the "trajectory of the Russian invasion."
    "The group's interest in Ukraine follows historical targeting of government entities in Russia for strategic intelligence gathering purposes," security researchers Greg Lesnewich, Saher Naumaan, and Mark Kelly said in a report shared with The Hacker News.
    Konni APT, also known as Opal Sleet, Osmium, TA406, and Vedalia, is a cyber espionage group that has a history of targeting entities in South Korea, the United States, and Russia.
    It's operational since at least 2014.
    Attack chains mounted by the threat actor often involve the use of phishing emails to distribute malware called Konni RAT (aka UpDog) and redirect recipients to credential harvesting pages.
    Proofpoint, in an analysis of the threat group published in November 2021, assessed TA406 to be one of several actors that make up the activity publicly tracked as Kimsuky, Thallium, and Konni Group.
    The latest set of attacks documented by the cybersecurity company entails the use of phishing emails that impersonate a fictitious senior fellow at a think tank called the Royal Institute of Strategic Studies, which is also a non-existent organization.
    The email messages contain a link to a password-protected RAR archive that's hosted on the MEGA cloud service.
    Opening the RAR archive using a password mentioned in the message body launches an infection sequence that's engineered to conduct extensive reconnaissance of the compromised machines.

    Specifically, present within the RAR archive is a CHM file that displays decoy content related to former Ukrainian military leader Valeriy Zaluzhnyi.
    Should the victim click anywhere on the page, a PowerShell command embedded within the HTML is executed to reach out to an external server and download a next-stage PowerShell payload.
    The newly launched PowerShell script is capable of executing various commands to gather information about the system, encode it using Base64-encoding, and send it to the same server.
    "The actor sent multiple phishing emails on consecutive days when the target did not click the link, asking the target if they had received the prior emails and if they would download the files," the researchers said.
    Proofpoint said it also observed an HTML file being directly distributed as an attachment to the phishing messages.
    In this variation of the attack, the victim is instructed to click on an embedded link in the HTML file, resulting in the download of a ZIP archive that includes a benign PDF and a Windows shortcut (LNK) file.
    When the LNK is run, it executes Base64-encoded PowerShell to drop a Javascript Encoded file called "Themes.jse" using a Visual Basic Script.
    The JSE malware, in turn, contacts an attacker-controlled URL and runs the response from the server via PowerShell.
    The exact nature of the payload is currently not known.
    Furthermore, TA406 has been spotted attempting to harvest credentials by sending fake Microsoft security alert messages to Ukrainian government entities from ProtonMail accounts, warning them of suspicious sign-in activity from IP addresses located in the United States and urging them to verify the login by visiting a link.
    While the credential harvesting page has not been recovered, the same compromised domain is said to have been used in the past to collect Naver login information.
    "These credential harvesting campaigns took place prior to the attempted malware deployments and targeted some of the same users later targeted with the HTML delivery campaign," Proofpoint said.
    "TA406 is very likely gathering intelligence to help North Korean leadership determine the current risk to its forces already in the theatre, as well as the likelihood that Russia will request more troops or armaments."
    "Unlike Russian groups who have likely been tasked with gathering tactical battlefield information and targeting of Ukrainian forces in situ, TA406 has typically focused on more strategic, political intelligence collection efforts."

    The disclosure comes as the Konni group has been linked to a sophisticated multi-stage malware campaign targeting entities in South Korea with ZIP archives containing LNK files, which run PowerShell scripts to extract a CAB archive and ultimately deliver batch script malware capable of collecting sensitive data and exfiltrating it to a remote server.
    The findings also dovetail with spear-phishing campaigns orchestrated by Kimsuky to target government agencies in South Korea by delivering a stealer malware capable of establishing command-and-control (C2 or C&C) communications and exfiltrating files, web browser data, and cryptocurrency wallet information.

    According to South Korean cybersecurity company AhnLab, Kimsuky has also been observed propagating PEBBLEDASH as part of a multi-stage infection sequence initiated via spear-phishing.
    The trojan was attributed by the U.S.
    government to the Lazarus Group in May 2020.
    "While the Kimsuky group uses various types of malware, in the case of PEBBLEDASH, they execute malware based on an LNK file by spear-phishing in the initial access stage to launch their attacks," it said.

    "They then utilize a PowerShell script to create a task scheduler and register it for automatic execution.
    Through communication with a Dropbox and TCP socket-based C&C server, the group installs multiple malware and tools including PEBBLEDASH."
    Konni and Kimsuky are far from the only North Korean threat actors to focus on Seoul.
    As recently as March 2025, South Korean entities have been found to be at the receiving end of another campaign carried out by APT37, which is also referred to as ScarCruft.
    Dubbed Operation ToyBox Story, the spear-phishing attacks singled out several activists focused on North Korea, per the Genians Security Center (GSC).
    The first observed spear phishing attack occurred on March 8, 2025.
    "The email contained a Dropbox link leading to a compressed archive that included a malicious shortcut (LNK) file," the South Korean company said.
    "When extracted and executed, the LNK file activated additional malware containing the keyword 'toy.'"

    The LNK files are configured to launch a decoy HWP file and run PowerShell commands, leading to the execution of files named toy03.bat, toy02.bat, and toy01.bat (in that order), the last of which contains shellcode to launch RoKRAT, a staple malware associated with APT37.
    RokRAT is equipped to collect system information, capture screenshots, and use three different cloud services, including pCloud, Yandex, and Dropbox for C2.
    "The threat actors exploited legitimate cloud services as C2 infrastructure and continued to modify shortcut (LNK) files while focusing on fileless attack techniques to evade detection by antivirus software installed on target endpoints," Genians said.

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.



    SHARE










    المصدر: https://thehackernews.com/2025/05/north-korean-konni-apt-targets-ukraine.html

    #North #Korean #Konni #APT #Targets #Ukraine #with #Malware #track #Russian #Invasion #Progress
    North Korean Konni APT Targets Ukraine with Malware to track Russian Invasion Progress
    May 13, 2025Ravie LakshmananCyber Espionage / Malware The North Korea-linked threat actor known as Konni APT has been attributed to a phishing campaign targeting government entities in Ukraine, indicating the threat actor's targeting beyond Russia. Enterprise security firm Proofpoint said the end goal of the campaign is to collect intelligence on the "trajectory of the Russian invasion." "The group's interest in Ukraine follows historical targeting of government entities in Russia for strategic intelligence gathering purposes," security researchers Greg Lesnewich, Saher Naumaan, and Mark Kelly said in a report shared with The Hacker News. Konni APT, also known as Opal Sleet, Osmium, TA406, and Vedalia, is a cyber espionage group that has a history of targeting entities in South Korea, the United States, and Russia. It's operational since at least 2014. Attack chains mounted by the threat actor often involve the use of phishing emails to distribute malware called Konni RAT (aka UpDog) and redirect recipients to credential harvesting pages. Proofpoint, in an analysis of the threat group published in November 2021, assessed TA406 to be one of several actors that make up the activity publicly tracked as Kimsuky, Thallium, and Konni Group. The latest set of attacks documented by the cybersecurity company entails the use of phishing emails that impersonate a fictitious senior fellow at a think tank called the Royal Institute of Strategic Studies, which is also a non-existent organization. The email messages contain a link to a password-protected RAR archive that's hosted on the MEGA cloud service. Opening the RAR archive using a password mentioned in the message body launches an infection sequence that's engineered to conduct extensive reconnaissance of the compromised machines. Specifically, present within the RAR archive is a CHM file that displays decoy content related to former Ukrainian military leader Valeriy Zaluzhnyi. Should the victim click anywhere on the page, a PowerShell command embedded within the HTML is executed to reach out to an external server and download a next-stage PowerShell payload. The newly launched PowerShell script is capable of executing various commands to gather information about the system, encode it using Base64-encoding, and send it to the same server. "The actor sent multiple phishing emails on consecutive days when the target did not click the link, asking the target if they had received the prior emails and if they would download the files," the researchers said. Proofpoint said it also observed an HTML file being directly distributed as an attachment to the phishing messages. In this variation of the attack, the victim is instructed to click on an embedded link in the HTML file, resulting in the download of a ZIP archive that includes a benign PDF and a Windows shortcut (LNK) file. When the LNK is run, it executes Base64-encoded PowerShell to drop a Javascript Encoded file called "Themes.jse" using a Visual Basic Script. The JSE malware, in turn, contacts an attacker-controlled URL and runs the response from the server via PowerShell. The exact nature of the payload is currently not known. Furthermore, TA406 has been spotted attempting to harvest credentials by sending fake Microsoft security alert messages to Ukrainian government entities from ProtonMail accounts, warning them of suspicious sign-in activity from IP addresses located in the United States and urging them to verify the login by visiting a link. While the credential harvesting page has not been recovered, the same compromised domain is said to have been used in the past to collect Naver login information. "These credential harvesting campaigns took place prior to the attempted malware deployments and targeted some of the same users later targeted with the HTML delivery campaign," Proofpoint said. "TA406 is very likely gathering intelligence to help North Korean leadership determine the current risk to its forces already in the theatre, as well as the likelihood that Russia will request more troops or armaments." "Unlike Russian groups who have likely been tasked with gathering tactical battlefield information and targeting of Ukrainian forces in situ, TA406 has typically focused on more strategic, political intelligence collection efforts." The disclosure comes as the Konni group has been linked to a sophisticated multi-stage malware campaign targeting entities in South Korea with ZIP archives containing LNK files, which run PowerShell scripts to extract a CAB archive and ultimately deliver batch script malware capable of collecting sensitive data and exfiltrating it to a remote server. The findings also dovetail with spear-phishing campaigns orchestrated by Kimsuky to target government agencies in South Korea by delivering a stealer malware capable of establishing command-and-control (C2 or C&C) communications and exfiltrating files, web browser data, and cryptocurrency wallet information. According to South Korean cybersecurity company AhnLab, Kimsuky has also been observed propagating PEBBLEDASH as part of a multi-stage infection sequence initiated via spear-phishing. The trojan was attributed by the U.S. government to the Lazarus Group in May 2020. "While the Kimsuky group uses various types of malware, in the case of PEBBLEDASH, they execute malware based on an LNK file by spear-phishing in the initial access stage to launch their attacks," it said. "They then utilize a PowerShell script to create a task scheduler and register it for automatic execution. Through communication with a Dropbox and TCP socket-based C&C server, the group installs multiple malware and tools including PEBBLEDASH." Konni and Kimsuky are far from the only North Korean threat actors to focus on Seoul. As recently as March 2025, South Korean entities have been found to be at the receiving end of another campaign carried out by APT37, which is also referred to as ScarCruft. Dubbed Operation ToyBox Story, the spear-phishing attacks singled out several activists focused on North Korea, per the Genians Security Center (GSC). The first observed spear phishing attack occurred on March 8, 2025. "The email contained a Dropbox link leading to a compressed archive that included a malicious shortcut (LNK) file," the South Korean company said. "When extracted and executed, the LNK file activated additional malware containing the keyword 'toy.'" The LNK files are configured to launch a decoy HWP file and run PowerShell commands, leading to the execution of files named toy03.bat, toy02.bat, and toy01.bat (in that order), the last of which contains shellcode to launch RoKRAT, a staple malware associated with APT37. RokRAT is equipped to collect system information, capture screenshots, and use three different cloud services, including pCloud, Yandex, and Dropbox for C2. "The threat actors exploited legitimate cloud services as C2 infrastructure and continued to modify shortcut (LNK) files while focusing on fileless attack techniques to evade detection by antivirus software installed on target endpoints," Genians said. Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE     المصدر: https://thehackernews.com/2025/05/north-korean-konni-apt-targets-ukraine.html #North #Korean #Konni #APT #Targets #Ukraine #with #Malware #track #Russian #Invasion #Progress
    THEHACKERNEWS.COM
    North Korean Konni APT Targets Ukraine with Malware to track Russian Invasion Progress
    May 13, 2025Ravie LakshmananCyber Espionage / Malware The North Korea-linked threat actor known as Konni APT has been attributed to a phishing campaign targeting government entities in Ukraine, indicating the threat actor's targeting beyond Russia. Enterprise security firm Proofpoint said the end goal of the campaign is to collect intelligence on the "trajectory of the Russian invasion." "The group's interest in Ukraine follows historical targeting of government entities in Russia for strategic intelligence gathering purposes," security researchers Greg Lesnewich, Saher Naumaan, and Mark Kelly said in a report shared with The Hacker News. Konni APT, also known as Opal Sleet, Osmium, TA406, and Vedalia, is a cyber espionage group that has a history of targeting entities in South Korea, the United States, and Russia. It's operational since at least 2014. Attack chains mounted by the threat actor often involve the use of phishing emails to distribute malware called Konni RAT (aka UpDog) and redirect recipients to credential harvesting pages. Proofpoint, in an analysis of the threat group published in November 2021, assessed TA406 to be one of several actors that make up the activity publicly tracked as Kimsuky, Thallium, and Konni Group. The latest set of attacks documented by the cybersecurity company entails the use of phishing emails that impersonate a fictitious senior fellow at a think tank called the Royal Institute of Strategic Studies, which is also a non-existent organization. The email messages contain a link to a password-protected RAR archive that's hosted on the MEGA cloud service. Opening the RAR archive using a password mentioned in the message body launches an infection sequence that's engineered to conduct extensive reconnaissance of the compromised machines. Specifically, present within the RAR archive is a CHM file that displays decoy content related to former Ukrainian military leader Valeriy Zaluzhnyi. Should the victim click anywhere on the page, a PowerShell command embedded within the HTML is executed to reach out to an external server and download a next-stage PowerShell payload. The newly launched PowerShell script is capable of executing various commands to gather information about the system, encode it using Base64-encoding, and send it to the same server. "The actor sent multiple phishing emails on consecutive days when the target did not click the link, asking the target if they had received the prior emails and if they would download the files," the researchers said. Proofpoint said it also observed an HTML file being directly distributed as an attachment to the phishing messages. In this variation of the attack, the victim is instructed to click on an embedded link in the HTML file, resulting in the download of a ZIP archive that includes a benign PDF and a Windows shortcut (LNK) file. When the LNK is run, it executes Base64-encoded PowerShell to drop a Javascript Encoded file called "Themes.jse" using a Visual Basic Script. The JSE malware, in turn, contacts an attacker-controlled URL and runs the response from the server via PowerShell. The exact nature of the payload is currently not known. Furthermore, TA406 has been spotted attempting to harvest credentials by sending fake Microsoft security alert messages to Ukrainian government entities from ProtonMail accounts, warning them of suspicious sign-in activity from IP addresses located in the United States and urging them to verify the login by visiting a link. While the credential harvesting page has not been recovered, the same compromised domain is said to have been used in the past to collect Naver login information. "These credential harvesting campaigns took place prior to the attempted malware deployments and targeted some of the same users later targeted with the HTML delivery campaign," Proofpoint said. "TA406 is very likely gathering intelligence to help North Korean leadership determine the current risk to its forces already in the theatre, as well as the likelihood that Russia will request more troops or armaments." "Unlike Russian groups who have likely been tasked with gathering tactical battlefield information and targeting of Ukrainian forces in situ, TA406 has typically focused on more strategic, political intelligence collection efforts." The disclosure comes as the Konni group has been linked to a sophisticated multi-stage malware campaign targeting entities in South Korea with ZIP archives containing LNK files, which run PowerShell scripts to extract a CAB archive and ultimately deliver batch script malware capable of collecting sensitive data and exfiltrating it to a remote server. The findings also dovetail with spear-phishing campaigns orchestrated by Kimsuky to target government agencies in South Korea by delivering a stealer malware capable of establishing command-and-control (C2 or C&C) communications and exfiltrating files, web browser data, and cryptocurrency wallet information. According to South Korean cybersecurity company AhnLab, Kimsuky has also been observed propagating PEBBLEDASH as part of a multi-stage infection sequence initiated via spear-phishing. The trojan was attributed by the U.S. government to the Lazarus Group in May 2020. "While the Kimsuky group uses various types of malware, in the case of PEBBLEDASH, they execute malware based on an LNK file by spear-phishing in the initial access stage to launch their attacks," it said. "They then utilize a PowerShell script to create a task scheduler and register it for automatic execution. Through communication with a Dropbox and TCP socket-based C&C server, the group installs multiple malware and tools including PEBBLEDASH." Konni and Kimsuky are far from the only North Korean threat actors to focus on Seoul. As recently as March 2025, South Korean entities have been found to be at the receiving end of another campaign carried out by APT37, which is also referred to as ScarCruft. Dubbed Operation ToyBox Story, the spear-phishing attacks singled out several activists focused on North Korea, per the Genians Security Center (GSC). The first observed spear phishing attack occurred on March 8, 2025. "The email contained a Dropbox link leading to a compressed archive that included a malicious shortcut (LNK) file," the South Korean company said. "When extracted and executed, the LNK file activated additional malware containing the keyword 'toy.'" The LNK files are configured to launch a decoy HWP file and run PowerShell commands, leading to the execution of files named toy03.bat, toy02.bat, and toy01.bat (in that order), the last of which contains shellcode to launch RoKRAT, a staple malware associated with APT37. RokRAT is equipped to collect system information, capture screenshots, and use three different cloud services, including pCloud, Yandex, and Dropbox for C2. "The threat actors exploited legitimate cloud services as C2 infrastructure and continued to modify shortcut (LNK) files while focusing on fileless attack techniques to evade detection by antivirus software installed on target endpoints," Genians said. Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    
    ·43 Views