Operation ControlPlug describes DarkPeony activity using MSC files as an initial attack vector against possible military and government targets in Myanmar, the Philippines, Mongolia, and Serbia. The report explains that opening the MSC file and clicking its embedded link runs PowerShell, downloads an MSI package, and executes a side-loaded payload chain involving EXE, DLL, and DAT files.