RAT

KONNI

RAT Needs review 26 detections found

This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as rat-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: KONNI

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0356) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

KONNI, Software S0356 — MITRE ATT&CK

Detection rules

Source	Rule	Status	Updated
suricata	ET MALWARE Possible KONNI URI Path Observed	rev 5	2024-05-29
snort	ET TROJAN Possible KONNI URI Path Observed	rev 3	2024-05-29
suricata	ET MALWARE [ANY.RUN] Konni.APT Keep-Alive	rev 2	2024-04-27
suricata	ET MALWARE [ANY.RUN] Konni.APT Exfiltration	rev 3	2024-04-03
suricata	ET MALWARE Konni Group CnC Domain in DNS Lookup	rev 2	2024-03-26
suricata	ET MALWARE Konni Group CnC Domain in DNS Lookup	rev 2	2024-03-26
suricata	ET MALWARE Konni Group CnC Domain in DNS Lookup	rev 2	2024-03-26
suricata	ET MALWARE Possible KONNI CnC Activity	rev 4	2024-03-12
suricata	ET MALWARE Possible Konni Encrypted Stage 2 Payload Inbound via HTTP	rev 3	2024-03-07
snort	ET TROJAN Possible Konni RAT Related Activity Observed	rev 1	2023-10-30
suricata	ET MALWARE Possible Konni RAT Related Activity Observed	rev 1	2023-10-30
snort	ET TROJAN [ANY.RUN] Konni.APT Keep-Alive	rev 1	2023-09-01
snort	ET TROJAN [ANY.RUN] Konni.APT Exfiltration	rev 1	2023-09-01
snort	ET TROJAN Konni RAT Exfiltrating Data	rev 2	2023-04-04
snort	ET TROJAN Possible KONNI CnC Activity	rev 3	2022-06-30
snort	ET TROJAN Konni Group CnC Domain in DNS Lookup	rev 2	2022-01-04
snort	ET TROJAN Konni Group CnC Domain in DNS Lookup	rev 2	2022-01-04
snort	ET TROJAN Konni Group CnC Domain in DNS Lookup	rev 2	2022-01-04
suricata	ET MALWARE Konni RAT Querying CnC for Commands	rev 1	2021-08-25
suricata	ET MALWARE Konni RAT Exfiltrating Data	rev 1	2021-08-25
snort	ET TROJAN Konni RAT Querying CnC for Commands	rev 1	2021-08-25
suricata	ET MALWARE Konni Related Activity	rev 1	2021-03-25
snort	ET TROJAN Konni Related Activity	rev 2	2021-03-25
snort	ET TROJAN Konni Stage 2 Payload Exfiltrating Data	rev 2	2020-05-26
snort	ET TROJAN Possible Konni Encrypted Stage 2 Payload Inbound via HTTP	rev 2	2020-05-26
suricata	ET MALWARE Konni Stage 2 Payload Exfiltrating Data	rev 1	2020-05-26