North Korean APT group KONNI deployed AI-generated PowerShell backdoors targeting blockchain and cryptocurrency developers in Japan, Australia, and India. Check Point Research published findings on 21 January 2026, documenting the campaign's use of Discord-hosted malicious archives.