Trojanised KMS Activators Carry Konni Espionage Implant, WinDivert Sniffer

A KMS Activator That Knows How to Spy: WinDivert, Konni, and the Piracy-Lure Playbook

Five trojanised Windows activation tools — distributed under the names KMSpico, KMSAuto, and AAct — carry an embedded user-mode packet-capture driver that has no legitimate place in any licensing utility. The YARA rule WinDivert_Driver fires on all five samples, and on one of them, AAct_x64.exe (sha256: db3aa782e297b2b5d9e2a1281ebb9afd416c82722c2d2a285ef94070e4cdd5d2), a second rule fires alongside it: win_konni_auto, a Malpedia-sourced signature that detects the Konni espionage implant family. What presents to a user as a portable Windows activator is, by the measure of that YARA hit, carrying or dropping a named espionage payload. CTX Team has attributed this seven-file cluster to Gamaredon Group, with espionage motivation and defence-sector targeting, and the technical evidence across the full set supports that framing in ways that go well beyond a single rule match.

Two Build Pipelines, One Operational Requirement

The seven files divide cleanly into two builder cohorts and two outliers, and the cohort structure is itself evidence. The first pipeline produced three .NET assemblies — KMSELDI.exe, AutoPico.exe, and Service_KMS.exe — all signed by the same self-issued authority, "@ByELDI; @ByELDI Certificate Authority," carrying serial number CB C9 53 5C 7A 4B 70 DE 52 6C 01 39 FE AF 2C 9C, valid from January 2016 through January 2046. All three share an identical PE import-table hash of f34d5f2d4577ed6d9ceec516c1f5a744 and the same PEiD packer signature, confirming they were compiled from a single build environment. Their PE timestamps are all stamped 2016-01-11, the same date the certificate was minted — a cert issued and immediately put to work.

The second pipeline produced two x86-64 executables — AAct_x64.exe and KMSAuto x64.exe — signed by a different self-issued authority, "WZTeam," carrying serial 8A C1 A3 10 13 49 C2 8A 4D 33 94 7C FC D0 76 62, valid from November 2016 through December 2039. These two share imphash 7d6d1e9e2408e732d49428767abf2778 and are both UPX-packed, with their UPX1 sections registering entropy of 7.88 and 7.80 respectively — consistent with aggressive compression designed to frustrate static analysis. The two pipelines are otherwise independent: different signers, different imphashes, different file formats, different packing strategies.

What ties them together is the WinDivert_Driver YARA rule. It fires on all five samples from both pipelines — KMSELDI.exe, AutoPico.exe, Service_KMS.exe, AAct_x64.exe, and KMSAuto x64.exe — regardless of which builder produced them. WinDivert is a user-mode library that enables interception and modification of raw network packets at the Windows network stack level. A KMS activation tool has no architectural need for that capability. Its uniform presence across two otherwise distinct build environments points to a shared operational design requirement: the campaign's operators specified packet-capture capability as a feature, and both builder teams implemented it. That is a campaign-level coordination signal, not a coincidence of shared libraries.

The Signing Posture: Four Certificates, None Trustworthy

The code-signing picture across the seven files is deliberately varied, and that variety is itself a fingerprint. The three @ByELDI-signed .NET assemblies display a "signed" tag to any tool that checks for the presence of a signature without validating the chain. The verified field on all three reads: "A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider." The @ByELDI Certificate Authority is self-issued — it signs itself, making the entire chain unanchored to any public trust store. The cert has a 30-year validity window (2016–2046), suggesting the operator intended it as a long-lived signing infrastructure rather than a single-operation credential.

The WZTeam pipeline uses the same structural trick: the WZTeam certificate (serial 8A C1 A3 10 13 49 C2 8A 4D 33 94 7C FC D0 76 62) is also self-issued, also untrusted-root, also carrying a multi-decade validity window running to 2039. Both self-signed authorities achieve the same goal: a binary that displays as "signed" under casual inspection — in Windows Explorer properties, in some EDR telemetry fields, in user-facing installer dialogs — while failing chain validation the moment any tool actually checks the trust anchor [T1553.002].

The two outlier samples introduce a third and fourth signing posture. DriverPack-17-Online.exe (3821895d6df56147856b21ad6f50711f074bc4d46ecb5a759ad00fbbe9856337) carries a genuine Sectigo chain — leaf certificate issued to "Kuzyakov Artur Vyacheslavovich IP" by Sectigo RSA Code Signing CA, rooted in USERTrust RSA Certification Authority. The chain is structurally valid. The problem is timing: the leaf certificate expired on 2020-08-08, and the file was first seen on VirusTotal on 2020-05-04, signed on 2020-05-04. At the time of signing the cert was technically valid; by the time this sample circulates today, the leaf is flagged "not time valid." This is a real CA chain used past its validity window — a pattern consistent with opportunistic reuse of a previously obtained certificate rather than a controlled signing operation.

The fourth signing posture belongs to AutoItRun.exe (77c2372364b6dd56bc787fda46e6f4240aaa0353ead1e3071224d454038a545e), which carries a COMODO-issued certificate in the name of "Alfredo Anibal Santos Silva" (serial 00 D0 28 A3 6B BE 4E C1 B7 FB F8 0D 51 7A 1B 56 C6). The verified field on this sample reads: "A certificate was explicitly revoked by its issuer." The revoked-cert tag confirms it. The file presents as "Ultra Virus Killer" by Carifred but is an AutoIt-compiled executable — the YARA rule AutoIT_Compiled fires twice on it — masquerading under the internal name AutoItRun.exe. It shares no imphash, no signer, and no threat label with any other sample in the set.

The diversity of signing postures across a single seven-file cluster — self-issued untrusted roots on five samples, an expired legitimate CA chain on one, a revoked legitimate CA chain on another — suggests the operator is sourcing certificates opportunistically rather than maintaining a controlled signing infrastructure. Each posture achieves the same surface-level goal (a "signed" binary) through a different mechanism, implying the operator is willing to use whatever certificate material is available rather than investing in a single durable signing identity.

The Evasion Stack: Layers That Accumulate

The defense-evasion architecture applied across this cluster is not a single technique but an accumulation of layers, and the layers differ by pipeline in ways that reveal deliberate engineering choices.

The @ByELDI .NET trio applies Dotfuscator obfuscation — the YARA rule INDICATOR_EXE_Packed_Dotfuscator fires on all three — and additionally carries the FormhookB rule, which detects a Formbook-style anti-hook bypass. Formbook is a well-documented commercial RAT whose anti-analysis hooking bypass has been extracted and repurposed in other malware families; its presence in what are nominally KMS activation tools indicates deliberate embedding of anti-analysis code borrowed from or shared with the Formbook ecosystem. The combination of Dotfuscator obfuscation and a hook-bypass routine goes well beyond what any legitimate activation utility would require. The Multifamily_RAT_Detection rule also fires across all three @ByELDI samples, a generic signature that catches code patterns common to multiple RAT families — consistent with the FormhookB finding and with the broader espionage-implant attribution.

The WZTeam UPX pair takes a different approach. Rather than .NET obfuscation, AAct_x64.exe and KMSAuto x64.exe are packed with UPX, with UPX1 sections at entropy 7.88 and 7.80 — high enough to defeat most static unpacking attempts without a dedicated unpacker. On top of the UPX packing, both samples embed registry key and value combinations designed to suppress Windows Defender: the YARA rule INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender fires on both. Disabling Windows Defender through registry manipulation [T1553] is a direct defense-evasion step that complements the packing — the packing defeats static analysis, the registry manipulation defeats runtime monitoring.

The net effect is a cluster where every sample applies at least two distinct evasion mechanisms, and where the mechanisms are tailored to the build environment: .NET obfuscation plus hook bypass for the managed-code pipeline, UPX packing plus Defender disablement for the native x64 pipeline. The WinDivert_Driver capability sits underneath all of it, uniform across both pipelines, as a shared operational layer.

Detection ratios across the cluster reflect this evasion investment. AAct_x64.exe scores 58 of 76 engines — the highest in the set — while Service_KMS.exe scores only 25 of 76, with 0 of 1 sandbox verdicts returning malicious. The @ByELDI .NET trio sits in the 25–48 of 76 range, with community votes on KMSELDI.exe running 7 malicious to 32 harmless, reflecting genuine user confusion about whether these tools are malicious or merely unwanted. That confusion is the campaign's primary social-engineering asset.

The Attack Chain: Piracy as Initial Access

The entry point for this campaign is not a spearphishing email or a watering-hole exploit. It is user demand. Someone needs to activate a Windows installation without a license, or needs to install drivers without paying for a driver management tool, and they search for a free solution. They find KMSpico, KMSAuto, AAct, or DriverPack. They download and execute the file [T1204.002]. The submission counts confirm how broadly this works: KMSELDI.exe has been submitted to VirusTotal from 2,816 unique sources across 3,631 total submissions; AutoPico.exe from 2,380 unique sources across 2,990 submissions; KMSAuto x64.exe from 1,269 unique sources across 1,470 submissions. These are not targeted delivery numbers — they are the footprint of software that circulates freely and gets executed by users who believe they are running a legitimate tool.

The code-signing certificates are part of this initial-access design [T1553.002]. A user who checks whether a downloaded executable is "signed" — as many security-conscious users have been trained to do — will see that these files carry signatures. The chain validation failure is invisible unless they inspect the certificate details. The @ByELDI and WZTeam self-signed roots are designed to pass the casual "is it signed?" check while failing the rigorous "is the chain trusted?" check. The DriverPack installer goes further: it carries a structurally valid Sectigo chain that would have passed full validation at the time of signing in May 2020, making it the most convincing lure in the set for users who actually verify certificate chains.

Once executed, the persistence mechanism for the KMSpico component set is service-based. AutoPico.exe carries the persistence and executes-dropped-file behavioral tags, and Zenbox classifies it as MALWARE/EVADER at 72% confidence across 2 of 3 sandbox verdicts returning malicious. Service_KMS.exe is installed to C:\Program Files\KMSpico\Service_KMS.exe — a path that mimics legitimate software installation and would not trigger obvious suspicion in a process listing or a file-system audit. The service installation provides the persistence foothold [T1195] that keeps the implant resident across reboots without requiring any further user interaction.

The WinDivert packet-capture capability embedded across all five KMS-family samples then operates at the network layer, intercepting and potentially modifying traffic passing through the compromised host. Three samples — KMSELDI.exe, AutoPico.exe, and KMSAuto x64.exe — carry the via-tor behavioral tag, indicating that sandbox analysis observed network communications routed through Tor. AutoPico.exe additionally triggered two Snort IDS rules in sandbox: PROTOCOL-ICMP Unusual PING detected (medium severity, category successful-recon-limited) and PROTOCOL-ICMP Echo Reply (low severity, category misc-activity). These IDS hits indicate active network reconnaissance behavior during sandbox execution — the sample was probing its environment, not simply sleeping.

The sharpest single indicator in the entire chain is the win_konni_auto YARA rule firing on AAct_x64.exe. This rule, authored by Felix Bilstein and sourced from the Malpedia/Fraunhofer FKIE repository, detects the Konni espionage implant family — a .NET-based remote access tool historically associated with intelligence-collection operations. Its presence on a file that presents as a portable KMS activator means one of two things: the activator shell carries Konni-family code embedded within it, or it drops a Konni-family payload at execution time. Either reading places this sample in a different category from the other KMS tools in the set, and it is the single strongest indicator corroborating the espionage attribution and defence-sector targeting that CTX Team's upstream feed assigns to this cluster.

The DriverPack Outlier and the AutoIt Ghost

Two samples sit outside the KMS-family cohort entirely, and their isolation is analytically significant.

DriverPack-17-Online.exe (3821895d6df56147856b21ad6f50711f074bc4d46ecb5a759ad00fbbe9856337) shares no imphash, no signer, and no threat label with any of the five KMS-family files. Its format is distinct — a Nullsoft NSIS self-extracting installer rather than a standalone PE — and its build provenance reflects a different toolchain: packed by F-PROT, Cyren, and Varist signatures, with imphash 57e98d9a5a72c8d7ad8fb7a6a58b3daf unique to this sample. Yet it receives the most severe sandbox verdict in the entire set: Zenbox classifies it MALWARE/STEALER/RANSOM/PHISHING/TROJAN/EVADER at 100% confidence, with Dr.Web vxCube and Lastline also returning malicious verdicts, for a 3 of 5 sandbox consensus. The community vote on this file runs 11 malicious to 3 harmless — a much stronger malicious signal than the KMS tools, which benefit from genuine user confusion about their status.

The Sectigo chain on this file (Kuzyakov Artur Vyacheslavovich IP → Sectigo RSA Code Signing CA → USERTrust RSA CA) is the most convincing signing posture in the set. A user or automated tool that checks the chain would find a real CA, a real intermediate, a real root — and would need to check the leaf certificate's validity dates to discover that it expired on 2020-08-08. The STEALER and RANSOM classifications from Zenbox indicate this is not merely an unwanted driver installer but a multi-capability payload. Its presence in the same campaign cluster as the KMS-family tools suggests it functions as a parallel supply-chain lure [T1195.002] targeting users who seek driver management software rather than Windows activation tools — a different user population, a different lure, the same campaign.

AutoItRun.exe (77c2372364b6dd56bc787fda46e6f4240aaa0353ead1e3071224d454038a545e) is the set's weakest indicator by most measures: 31 of 76 engines flag it, 0 of 2 sandboxes return malicious, and it is isolated from all other samples by imphash, signer, and threat label. Its COMODO-issued certificate was explicitly revoked by the issuer — the revoked-cert tag and the verified field "A certificate was explicitly revoked by its issuer" both confirm this — and the file presents as "Ultra Virus Killer" by Carifred while internally being an AutoIt-compiled executable (the AutoIT_Compiled YARA rule fires twice). The SUSP_Imphash_Mar23_3 rule also fires, flagging an imphash pattern found in fewer than 0.25% of VirusTotal submissions — a statistically unusual fingerprint. Despite the low sandbox consensus, the community vote runs 24 malicious to 2 harmless, suggesting that users who have encountered this file have strong opinions about its nature. Its connection to the broader cluster is thin enough that it should be treated as a low-confidence association rather than a confirmed campaign component.

No Network Map, But a C2 Posture That Explains Why

One of the most analytically significant facts about this cluster is the complete absence of network IOCs — no IP addresses, domains, or URLs were recovered from any sample. The C2 infrastructure for this campaign is entirely uncharted, forcing reliance on behavioral tags and IDS rule hits rather than direct infrastructure evidence.

That absence is not a data-collection failure. It is a deliberate operational posture. Three samples carry the via-tor behavioral tag, indicating that when these files communicate outbound, they route through the Tor anonymisation network. Tor exit nodes are ephemeral and non-attributable; no resolved onion addresses or exit-node IPs were recovered because the sandbox environments either did not capture them or the samples did not resolve them during the observation window. The WinDivert packet-capture capability embedded in all five KMS-family samples provides a complementary mechanism: rather than establishing a noisy outbound beacon, the operator can intercept credentials, session tokens, or other data from the host's existing network traffic and exfiltrate it through a Tor-routed channel that leaves no persistent infrastructure fingerprint.

The practical consequence is that the campaign's infrastructure remains operationally intact. There are no domains to sinkhole, no IP addresses to block at the perimeter, no certificate serials to pivot on for network-layer detection. The only reliable detection surface is the endpoint: the YARA rules that fire on the binaries, the behavioral tags that sandbox analysis generates, and the registry modifications that the WZTeam UPX pair attempts. The INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender rule on AAct_x64.exe and KMSAuto x64.exe is the most operationally actionable signal in the set — it fires before the Defender suppression takes effect, giving a narrow window for endpoint detection.

The two self-signed certificate authorities — @ByELDI Certificate Authority and WZTeam — function as the campaign's only persistent infrastructure fingerprint. Both have multi-decade validity windows, both are self-issued, and both have been in use since 2016. They are not infrastructure in the network sense, but they are the most durable identifiers the operator has left behind: any new sample signed by either authority can be immediately associated with this campaign regardless of its filename, packing, or behavioral profile.

Gamaredon Attribution and What the Konni Hit Means

CTX Team's upstream threat feed attributes this cluster to Gamaredon Group, also tracked under aliases including Shuckworm, Aqua Blizzard, UAC-0010, Actinium, Primitive Bear, and approximately a dozen others. The attribution carries espionage motivation and defence-sector targeting. The state-aligned-Russian alignment is inferred from the actor name and alias set — the alias "Aqua Blizzard" is a Microsoft designation historically associated with Russian state-aligned activity — but current evidence is too thin to confirm this alignment independently, so that characterisation should be read as medium-confidence inference rather than confirmed fact.

What the evidence does establish is the espionage-implant connection. The win_konni_auto YARA rule on AAct_x64.exe links a commodity-appearing KMS activator to the Konni family — a .NET-based RAT documented in connection with intelligence-collection operations. The Konni family is distinct from Gamaredon's primary toolset, which raises a question the evidence cannot fully answer: is this a Gamaredon operator using Konni-family code as a secondary payload, or is the attribution to Gamaredon itself uncertain and the Konni hit the more reliable indicator of the actual operator? Current evidence does not resolve this. What the evidence does establish is that the win_konni_auto hit on db3aa782e297b2b5d9e2a1281ebb9afd416c82722c2d2a285ef94070e4cdd5d2 is the single strongest technical indicator of espionage intent in the entire cluster, and it appears on a file that 58 of 76 engines flag and that carries the WinDivert packet-capture capability alongside it.

The defence-sector targeting attributed to this campaign is consistent with the delivery mechanism. Defence contractors, smaller defence suppliers, and personnel at defence-adjacent organisations are not immune to software licensing pressures — particularly in environments where IT procurement is slow, budgets are constrained, or personal devices are used for work. A KMS activator that circulates freely and appears signed is exactly the kind of tool that finds its way onto endpoints in those environments. The broad submission counts — KMSELDI.exe from 2,816 unique sources — confirm that the lures circulate well beyond any single targeted environment, which is consistent with a strategy of broad distribution followed by selective exploitation of high-value targets.

What This Tradecraft Signals About the Piracy-Lure Model

The convergence of commodity piracy-lure tradecraft with espionage-implant DNA in a single file cluster represents a meaningful shift in how the initial-access problem is being solved. Traditional spearphishing requires infrastructure: domains, email accounts, lure documents, delivery mechanisms that can be tracked and disrupted. The piracy-lure model requires none of that. The distribution network is the open internet — torrent sites, software repositories, forum posts, search engine results. The operator does not need to identify and contact targets; the targets identify themselves by searching for free software and executing whatever they find.

The WinDivert capability embedded uniformly across two distinct build pipelines is the clearest evidence that this is a deliberate campaign-level design rather than a legacy artefact from a single builder. If WinDivert were present in only one pipeline, it might be explained as a dependency of a specific KMS activation technique. Its presence across both the @ByELDI .NET pipeline and the WZTeam UPX pipeline — which share no imphash, no signer, and no packing method — means the operator specified it as a requirement and both builder teams implemented it. That is operational coordination, and it implies the network interception function serves a purpose that justifies the implementation cost across multiple build environments.

The Tor-routed C2 posture, combined with the absence of any network IOCs, suggests an operator who has learned from campaigns where C2 infrastructure was identified and disrupted. By routing through Tor and embedding packet-capture capability in the payload itself, the operator reduces their dependence on persistent network infrastructure that can be sinkholed or blocked. The campaign's infrastructure is, in effect, the victim's own network traffic — intercepted, collected, and exfiltrated through an anonymised channel that leaves no attributable footprint. That is a more mature operational posture than maintaining a dedicated C2 domain, and it is one that the current detection ecosystem is poorly equipped to counter at the network layer.

For the defence sector specifically, the implication is that the threat surface extends to any endpoint where software licensing compliance is inconsistently enforced — which, in practice, means a very large number of endpoints. The signing posture diversity documented in this cluster — four distinct certificate configurations across seven files — means that any detection strategy based on blocking specific signers or certificate serials will be incomplete. The @ByELDI and WZTeam self-signed roots are the most durable fingerprints available, but an operator who has already demonstrated the ability to use expired Sectigo chains and revoked COMODO certificates is unlikely to be constrained by the loss of any single signing identity. The win_konni_auto YARA rule on db3aa782e297b2b5d9e2a1281ebb9afd416c82722c2d2a285ef94070e4cdd5d2 is the sharpest single hook into this campaign's espionage layer — and it fires on a file that, to a user, looks exactly like a portable Windows activator.