NOKKI

Executive Summary

NOKKI is a modular Windows RAT first seen in early 2018, sharing code with the Konni family and likely employed by APT37. It provides persistent remote control, credential theft, and covert exfiltration via legitimate protocols, complicating detection. The malware’s plugin architecture allows attackers to expand capabilities dynamically.

NOKKI is a modular, Windows‑based remote access trojan that first surfaced in January 2018. The code base demonstrates significant overlap with the Konni family, suggesting shared development lineage or common authorship. Analysts have linked NOKKI to APT37 operations, and it has been discussed extensively by Unit 42 in their 2018 reports. Like its Konni counterpart, NOKKI is engineered for stealth and persistence. The toolkit includes a plug‑in architecture that allows operators to inject additional modules at runtime—enabling functionalities such as keylogging, credential dumping, remote file management, and lateral movement. Persistence mechanisms typically involve registry service creations or scheduled tasks, while clean‑up routines may remove registry entries upon disconnection. The RAT’s modularity also permits exfiltration over legitimate protocols, usually HTTP(S) or DNS tunneling, obfuscating traffic from baseline anomaly detection systems. When combined with APT37 activity, NOKKI is implicated in coordinated spear‑phishing campaigns that compromise internal accounts and plant the backdoor for long‑term access.

Key Capabilities

• Remote desktop & file management
• Persistence through registry services or scheduled tasks
• Credential dumping (SAM, LSASS), keylogging
• Plug‑in architecture enabling modular extensions
• Network reconnaissance and lateral movement
• Exfiltration over HTTP(S) and DNS tunneling
• Masquerading malware binaries and modules

ATT&CK Techniques

Recommended Actions

• Deploy EDR solutions that flag unknown PowerShell scripts and process injections.
• Monitor outbound traffic for unusual HTTP(S)/DNS connections to external IP addresses.
• Implement application whitelisting and disable execution of unsigned code on Windows endpoints.
• Regularly audit registry keys, scheduled tasks, and services for unknown entries.
• Use endpoint file‑integrity monitoring to detect changes in system files or new binaries.
• Block known NOKKI command‑and‑control domains/IPs via DNS filtering or firewall rules

Suggested Tags