North Korean KONNI APT Uses AI-Generated PowerShell Backdoors Against Blockchain Developers in Three Countries

On 21 January 2026, KONNI, a North Korean advanced persistent threat group, was reported to have used AI-generated PowerShell backdoors against blockchain and cryptocurrency developers in Japan, Australia, and India. The operation relied on Discord to distribute malicious ZIP archives containing a staged infection chain that established persistent access to victim systems. The campaign highlights the use of large language model-generated code in real-world attacks on crypto-focused development teams.