Konni activity described in the source uses an ECRM-themed HWP LNK lure that impersonates South Korea's cybercrime reporting system and launches mshta with obfuscated JavaScript and PowerShell commands. The malware chain relies on shortcut-file execution, encoded command content, and likely decoy-document context to gain initial execution while hiding malicious behavior from the victim.