ASEC reports a Konni phishing campaign that delivered a malicious executable disguised as material about a personal data leak. When run, the malware drops obfuscated JSE scripts, a PowerShell script, and a legitimate decoy document under ProgramData, then creates scheduled-task persistence through the JSE components. The PowerShell backdoor is designed to receive obfuscated XML-format commands from C2, but ASEC could not observe final operator behavior because the C2 was unavailable.