North Korean hacker group KONNI first used Google Find Hub feature to remotely erase Android device data

Deep潮 TechFlow News, November 11th, security researchers discovered that North Korean hacker group KONNI developed a new attack method, utilizing Google’s Find Hub asset tracking feature to remotely erase data on Android devices for the first time.

The attackers disguised themselves as psychologists and human rights activists, distributing malicious software called “Stress Relief Program” via the Korean KakaoTalk messaging platform. Once victims execute these files, the attackers steal Google account credentials, use the Find Hub feature to track device locations, and perform remote resets, resulting in personal data deletion.

This attack has been confirmed as a follow-up operation of KONNI APT activities, a group closely linked to the North Korean government-backed Kimsuky and APT37. Security experts recommend users strengthen account security, enable two-factor authentication, and remain cautious of files received through instant messaging tools.