Find-Hub

DFIR playbook for investigating a North Korea–linked campaign that steals Google credentials via signed MSI→AutoIt loaders on Windows, th...

APT37/KONNI abuse Google Find Hub to factory‑reset Androids mid‑intrusion

4n6 Beat
5 min read

North Korea-linked operators in the KONNI/APT37 orbit used stolen Google credentials to log into Google’s Find Hub and remotely trigger factory resets on victims’ Android phones and tablets, timing the wipes after checking GPS location to isolate targets and delay response (BleepingComputer, Nov 10, 2025; Genians Security Center report). Find Hub is Google’s rebranded “Find My Device” service that supports locating, locking, and erasing devices (Google Find Hub about; Android Authority rebrand coverage).