ESRC links Konni activity to Thallium/Kimsuky and describes spear-phishing campaigns that used North Korea-themed lures before expanding into cryptocurrency-related targeting. One malicious document masqueraded as a Huobi Research Weekly file, prompted macro execution, downloaded a DAT payload, and fetched a decoy document to reduce suspicion. The payload installed itself under a Chrome-like Roaming directory, executed through rundll32 with the insrchmdl argument, and established persistence through the Run registry key. The excerpt identifies C2 infrastructure including fighiting1013[.]org and naoei3-tosma.96[.]lt, and notes FTP-based command activity, attacker-staged variants, and overlap with Kimsuky-linked WSF tradecraft from Operation Cobra Venom.