Genians analyzed a Konni APT campaign that impersonated South Korean tax-related notices, including tax-evasion reports, source-of-funds explanations, and National Tax Service investigation themes. The attacks used spear-phishing emails containing ZIP archives with malicious LNK files, which invoked scripts such as BAT or VBS to begin the compromise chain. The campaign abused the legitimate AutoIt interpreter to run malicious script commands and evade traditional antivirus detection, with targets including people working on North Korea-related issues and some cryptocurrency traders.