QiAnXin analyzed Konni activity against South Korea that used oversized malicious LNK files with Korean language lure documents, including an email security check manual for Naver, Daum, and Gmail. The LNK files dropped a decoy document and a VBS script, then used GET requests to compromised website infrastructure such as shaira1885.com and messengerin.com to fetch follow on scripts. The scripts established scheduled task persistence, collected directory listings, public IP, process, system, and registry data, and exfiltrated files back to the C2 with host alias and filename fields. QiAnXin assesses the samples are more consistent with Konni than APT37, while noting shared LNK tradecraft with APT37 and Kimsuky.