The KONNI Remote Access Trojan (RAT) has been distributed by a small number of campaigns over the past 3 years. We have identified a new distribution campaign which took place on 4th July. The malware used in this campaign has similar features to that distributed earlier in 2017 with the following changes: A new decoy document copy/pasted from an article published on the 3rd of July by Yonhap News Agency in Korea. A new CC infrastructure consisting of a climbing club website.”]
Source: https://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html