FortiGuard described an ongoing Konni campaign using a Russian-language Word document with malicious macros. When the victim enables content, VBA extracts embedded ZIP contents, runs hidden batch scripts, deploys UPX-packed DLLs, and uses a wusa.exe UAC bypass before launching netpp.bat with elevated privileges. The RAT decrypts AES-CTR C2 configuration, collects system and process data, uploads encrypted CAB files to up.php, and polls dn.php for commands or payloads.