Cisco's Talos Intelligence Group Blog: KONNI: A Malware Under The Radar For Years

Talos' analysis describes the KONNI RAT and a series of targeted campaigns (2014–2017) that used malicious .src attachments and convincing decoy Office/JPG documents to deploy a multi-stage RAT capable of stealing browser data, keystrokes, files, taking screenshots, and executing commands; the report includes C2 domains, PHP endpoints, dropped filenames, numerous SHA256 sample hashes, and recommended detection/mitigation coverage.