The Invitation That Wasn't: Fake Crypto Conference Invites Deliver a PowerShell Backdoor

We gave an AI agent one goal: find recent malware aimed at people who work in crypto. It came back with fake invitations tied to two of the industry’s biggest events.

Key findings

• The agent found four Windows shortcuts posing as PDFs: an invitation to a side event at Korea Blockchain Week, a programme for Digital Asset Summit London, and two fake developer proposals.
• Opening one shows a convincing decoy while a PowerShell backdoor hides as a fake .err log and runs from a fake OneDrive task. The backdoor profiles the victim and lets the attacker run commands and move files.
• The backdoor matches the toolkit Check Point attributed to KONNI. The bait and the way the payload hides are new.

Why we went looking

On October 29, attackers took about $6.3 billion from Binance in roughly 20 minutes. It is the largest crypto theft ever recorded. According to Binance, it started with the laptop of one engineer. Two days later, the FBI said North Korea’s TraderTraitor group was behind it.

To be clear: nothing in this post is connected to the Binance attack. We only used it as the starting point for our own hunt.

There are many ways onto a crypto worker’s laptop: fake job interviews, fake Zoom updates, poisoned code packages, and more. This led us to investigate a more specific question: what kinds of attacks are currently targeting crypto professionals? To find out, we examined recent samples uploaded to Filescan, looking for evidence of these techniques in the wild.

The experiment

We recently released the MetaDefender Aether MCP, a way for AI assistants to emulate and hunt threats with filescan.io. We used it to give an AI agent a single goal:

Find recent malware on filescan.io that targets people working in crypto.

For the hunt itself, we gave it no threat feeds, no other sandboxes and no web search. Web search came in only afterwards, to add context such as event dates and attribution. The agent could only look at what Filescan had seen in the last few weeks. It chose its own searches, read the reports and followed the leads.

What it found: four invitations

The agent didn’t start from one trick. It searched across file types attackers like to send (Windows shortcuts, documents, emails, installers) and file names that lures tend to use, such as “invitation”. Among the shortcut samples identified, several used the .pdf.lnk double extension to disguise themselves as PDF documents. Since Windows hides known file extensions by default, these shortcuts may appear to users as .pdf files, concealing their true nature as Windows shortcuts (.lnk) capable of executing commands. This defense evasion technique is known as Masquerading: Double File Extension (T1036.007).

Among many generic invoice lures, four stood out. They pointed at the crypto world, and they were timed to real events:

• Sep 29. Korea Blockchain Week opens in Seoul. The same day, a ZIP with SANC_Nine_KBW_Seoul_Invitation.pdf.lnk reaches Filescan. It invites the reader to a real side event hosted by Sanctum and Superteam Korea.
• Oct 21. A ZIP with two fake developer documents: published-solidity-testing-environments.pdf.lnk and aletheia-unified-verification-environment-proposal.pdf.lnk. Solidity is the language used to write Ethereum smart contracts.
• Oct 22. DAS_London_2026_Programme.pdf.lnk, a “programme” for Blockworks’ Digital Asset Summit in London.
• Nov 10–11. DAS London takes place. The lure appeared about three weeks earlier.

The attackers even wrote down who they were after. The KBW decoy has a “Suggested audience” section that lists:

Founders and startup teams · Validators, staking and infrastructure companies · Wallet, exchange and custody teams · Investors, partnerships and ecosystem leads · Developers

That is the attackers’ own target list.

Page 1 of the KBW decoy. The details match the real event and the registration link is real.

The DAS London decoy is just as polished. It has five pages with the real dates and venue (London Hilton on Park Lane), the six programme themes, the side events, a list of announced speakers, and links and a QR code that all lead to the real Blockworks and Luma pages. Every page is a picture, not text, so there is nothing a simple text filter could read.

Cover of the fake DAS London programme. It is not a Blockworks document: the attackers made it, and its content label says it was created with ChatGPT on October 19.

What happens when the victim opens the “PDF”

The decoy is only what the victim sees. Behind it, opening the fake PDF (the shortcut) starts the chain below. All four files work the same way. The two developer lures from October 21 are a newer version with a few extra tricks, which we point out below. You can follow the chain in the Filescan report of the KBW shortcut.

1. The "PDF" runs a hidden scriptWindows opens the shortcut, which starts PowerShell in a hidden window.
2. It checks for a labIf it sees virtual-machine tools, debuggers or analysis tools like Wireshark or Procmon, it quits quietly.
3. A decoy opensThe victim sees a convincing PDF about the event or project. Nothing seems wrong.
4. The payload hides as a logAn encrypted file is saved as C:\ProgramData\Diagnosis\DiagnosisUTC_Storage_Error.err. It even starts with the word "Error:".
5. A fake OneDrive task keeps it aliveA scheduled task called "OneDrive Update Task-" decrypts and runs the payload every 30 minutes (every hour in the newer version).
6. The backdoor takes overIt profiles the machine, contacts its server every ~30 seconds, and runs any command or copies files on request.

The backdoor’s first job is to describe the victim. It collects the hardware, user name and privileges, public and local IP, installed software, antivirus and Microsoft Defender status, Wi-Fi name, cameras, screens, and the files and shortcuts on the desktop. The newer version also collects the system language and time zone.

With that report, the attacker can decide whether a victim is worth more effort. If it is, the backdoor can run Windows commands and PowerShell, and send files in both directions. From there, the attacker can do almost anything on the machine.

You can see this in the Filescan report of the decrypted KBW backdoor. The emulation shows it querying the BIOS, motherboard, disks and antivirus, looking up the public IP from several services, and running hundreds of XOR operations to decrypt its config.

Built to be picky

Several details show a careful operator, not a spam campaign:

• Each lure has its own key and its own server. If defenders block one, the others keep working.
• Lab checks at two stages. The shortcut checks first, and the backdoor checks again before each round of commands. The newer version also quits on machines with a small disk (under 160 GB), little memory (under 2 GB) or a virtual-machine vendor name.
• The operator left their test PCs in the code. The newer version skips the lab check on two computers, DESKTOP-FQ5RDVI and DESKTOP-CQBBB1O. These are almost certainly the attacker’s own test machines, a small slip.
• The decoys were written with AI. The DAS London programme carries a C2PA “content credential”, a signed label that says it was made with ChatGPT on October 19. One Solidity document lists its author as “AI Doc Maker”. The other lists “OpenAI”.
• One codebase. All four backdoors share the same internal name, SysInfoProject, and the same project ID. The ID is time-based and points to March 30, 2026, six months before the first lure. Treat that date as a hint: the ID is plain text in the script, and the attacker could have set it to anything. The toolkit itself is older; Check Point reported it in January.

The last mile: the backdoor

From Filescan, the agent mapped the chain: the lures, the lab check, the decoy, the hidden file, the scheduled task and the decryption keys. It also found the decrypted KBW backdoor, which another researcher had uploaded on October 11, and that showed what the backdoor collects.

One piece was left: where each backdoor reports to. The server address sits in a second encrypted config inside the backdoor. So we downloaded the samples and reversed them. With the keys the agent had found, we decrypted each payload, and then each config, without running anything.

Each config also carries a build name, such as SANC_Nine_KBW_Seoul and DAS_London. Both developer lures use solidity-test. And it shows how the backdoor talks to its server: small JSON messages marked LI to log in and send the victim profile, GC to get commands, and RP to report results.

That gave us four servers, one per lure:

• fe29jf323.kesug[.]com (KBW Seoul)
• h92jcihwicllow.wuaze[.]com (DAS London)
• e08f-67b173c2-34234332.site[.]je (Solidity)
• 026-u10-a16-z22-e.wuaze[.]com (Aletheia)

All four sit on free web-hosting subdomains. On November 5, none of them appeared in any other Filescan report.

The full chain at a glance, from the fake PDF to the backdoor’s server.

Who is behind it?

This backdoor has been seen before. In January 2026, Check Point Research described a PowerShell backdoor with the same internal name (SysInfoProject), the same cookie trick in front of free-hosted servers, and a scheduled task dressed up as OneDrive. That campaign also went after blockchain developers, with project documents sent as ZIP files over Discord. Check Point noted the code looked AI-written, and attributed it to KONNI, a North Korea-linked group.

What we found looks like a newer wave of the same toolkit. Two changes stand out:

• New bait. Check Point’s wave used project documents sent over Discord. This one uses invitations to real crypto conferences, timed to the events, plus two fake developer proposals.
• New payload hiding. Check Point’s backdoor sat in a .ps1 file encrypted with a one-byte XOR key. Here, one shortcut carries everything, and the payload hides in a fake .err log, encrypted with a 16-byte key mixed with a salt, and a different key for every lure.

Shared code is strong evidence, but it is not proof of the same operator. So our wording is: this matches the toolkit Check Point attributed to KONNI. And of course, there is no link to the Binance theft.

Want to run your own hunt? Connect the MetaDefender Aether MCP to your AI assistant, give it a goal, and see what it finds on filescan.io.

Indicators of compromise

Lures

File name	First seen	SHA-256	Report
SANC_Nine_KBW_Seoul_Invitation.pdf.lnk	2026-09-29	be5ba9de52af8ecd2fd7f6a97eeb8f05e8587bdcb01722bf26487dcc87489ac1	Filescan
published-solidity-testing-environments.pdf.lnk	2026-10-21	10a13e5adcbddcb8cce88436c41cadd5eb95d99b7bf1135fbcfc41cc57aad5f8	Filescan
aletheia-unified-verification-environment-proposal.pdf.lnk	2026-10-21	ec6a59f2c773d87c9fa5d6f90142c3013bd98a2b9dce24d5419c608e8896fec5	Filescan
DAS_London_2026_Programme.pdf.lnk	2026-10-22	09d7e0e75c70b8a95b48655971ea1a38bf10eb6cbe3fff135b878ca98d8e81cc	Filescan
ZIP (KBW)	2026-09-29	d782bdd883c0a1f8c484e50765a1481116f9e700fea7dc9e39df2ab4cb9dd8a2
ZIP (Solidity + Aletheia)	2026-10-21	a355496c47d79ab9ad373d34192e1d47580668642436912caf5b215d27db02be
ZIP (DAS)	2026-10-22	4adb8b4f38f0199a238831a9c8892bae329b8737e5c00d26eaf072b8b4e43106

Embedded payloads

Lure	Encrypted .err	Decrypted backdoor (.ps1)
KBW	6f574714403c37dd55531a25105c964a6522af7e58f2154f22905667d81eae10	805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094 (Filescan)
DAS	1c9714f6b66ef6088bfe6a2a05be8b41a8e6dce0c21baf727872ae9e7d57f25a	21fab098b51024e574ab34f74a6b8b3696028e348e01c9ddea7a204e3649391f
Solidity	1515eecc7d32ae5dfd7378da129dafc348fdf8a1b347a49462055498f8440df8	2e836c823b9233697468489f9d6ef2a9e42e0e0e8ed885042f9458d00cc0f999
Aletheia	cca40d18fcf264927332274cd77d7cbae6afddcec9e6d92df8460d441fb3937e	d18c2739f671ec970b58128c81fa504a0c6998f2bb8cc18ea4abf1fa8ca0cd63

The three non-KBW backdoor hashes are of the decoded script text and may differ from a copy taken from an infected machine.

Network and host

Type	Value
C2 URL	hxxps://fe29jf323.kesug[.]com/YE97Bw999zB87t1U8i.php
C2 URL	hxxps://h92jcihwicllow.wuaze[.]com/YE97Bw999zB87t1U8i.php
C2 URL	hxxps://e08f-67b173c2-34234332.site[.]je/234234234proxy.php
C2 URL	hxxps://026-u10-a16-z22-e.wuaze[.]com/234234234proxy.php
Mutex	Global\SysInfoProject_019d3efa-657d-73c5-b3d3-70a9a2ea5c39
File	C:\ProgramData\Diagnosis\DiagnosisUTC_Storage_Error.err
Scheduled task	OneDrive Update Task-<user SID>
Operator test hosts	DESKTOP-FQ5RDVI, DESKTOP-CQBBB1O