ESTsecurity analyzed a Konni-attributed APT case involving a malicious Hangul document themed around a legal dispute involving a Gwangju plastic surgery clinic. The report assesses that the document was likely delivered through spear phishing and used HWP content as the initial attack vector. The source references malicious script content and WHOIS-style infrastructure data, but the core evidence is the malicious document and its use by the Konni cluster. Defenders should treat the provided sample and infrastructure details as report-specific indicators while filtering out registrar and reference-domain noise.