360 Threat Intelligence Center reports that APT-C-28/ScarCruft, also known as Konni, conducted targeted attacks against South Korean entities using Korean-language lure documents related to rewards, payments, cryptocurrency, and contacts. The malicious macro documents downloaded or released CAB payloads, executed batch scripts, selected UAC-bypass methods based on system version and CPU architecture, and installed a disguised Remote Database Service Update service for persistence. The final remote-control DLL collected system and process information, encrypted uploads, and communicated with C2 infrastructure such as 4895750.c1.biz and 5645780.c1.biz. The report ties the activity to Konni based on targeting, lure style, CAB-based loading, remote-control behavior, and overlap with prior payloads used by the group.