CTI · reviewed · 2026-09-28

Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell Malware

Full story & timeline

MITRE ATT&CK

• T1193 Spearphishing Attachment Initial Access
• T1204 User Execution Execution
• T1053 Scheduled Task/Job Execution
• T1086 PowerShell Execution
• T1608 Stage Capabilities Resource Development

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Konni Operation Conflict Compass OneDriveUpdateScheduler Scheduled Task
id: 84ad05ae-c591-4224-a7b5-f2b24ce9a427
status: experimental
description: >
    Detects command lines creating the OneDriveUpdateScheduler scheduled task,
    the persistence mechanism of the Konni (TA406/Opal Sleet) Operation
    Conflict Compass campaign against Ukraine-focused entities: a LNK lure
    disguised as a PDF downloads a VBScript that registers the task to launch
    the VelvetCake PowerShell payload every minute (SOCRadar, September 2026).
references:
    - https://cyberpress.org/konni-targets-ukraine-with-velvetcake/
    - https://gbhackers.com/velvetcake-powershell-malware/
    - https://malware.news/t/konni-cv-olesiatsvientukh-socialresearcher-sociologist-qualitativelnk/125920#post_1
author: Tia N. List
date: 2026/09/28
tags:
    - attack.t1053
    - attack.t1086
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: 'OneDriveUpdateScheduler'
    selection_shell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
        CommandLine|contains: 'OneDriveUpdateScheduler'
    condition: selection_schtasks or selection_shell
falsepositives:
    - Security research or red-team tooling reproducing the published campaign artifacts
    - A legitimate updater task coincidentally named OneDriveUpdateScheduler (unlikely)
level: high

YARA-X raw

rule Konni_OperationConflictCompass_LNK_Lure {
    meta:
        author = "Tia N. List"
        date = "2026-09-28"
        status = "experimental"
        description = "Operation Conflict Compass (Konni / TA406 / Opal Sleet) artifacts against Ukraine-focused entities: the OneDriveUpdateScheduler scheduled task created by the staged VBScript and the Olesia Tsvientukh decoy-CV LNK lure delivered inside ZIP attachments; the task launches the VelvetCake PowerShell payload every minute. Derived from case analysis (SOCRadar) - NOT validated against a live sample."
        reference = "https://malware.news/t/konni-cv-olesiatsvientukh-socialresearcher-sociologist-qualitativelnk/125920#post_1"
        falsepositives = "Security research, sandboxes or red-team tooling embedding the same campaign artifact names; treat as a hunting signal, not a verdict"
    strings:
        $task = "OneDriveUpdateScheduler" ascii nocase
        $lure = "OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative" ascii nocase
    condition:
        any of them
}

References

• https://cyberpress.org/konni-targets-ukraine-with-velvetcake/
• https://gbhackers.com/velvetcake-powershell-malware/
• https://malware.news/t/konni-cv-olesiatsvientukh-socialresearcher-sociologist-qualitativelnk/125920#post_1