DCSO analyzed a KONNI sample uploaded to VirusTotal in January 2024 and assesses it as likely North Korea linked activity targeting Russia's Ministry of Foreign Affairs. The malware was bundled into a Russian language installer for a suspected internal consular reporting tool called Statistika KZU, which the bundled manuals describe as software for sending annual reports from overseas consulates to the MID through ViPNet. DCSO connects the delivery method to earlier KONNI use of backdoored Russian software installers, including a 2023 Spravki BK sample, and to similar activity against the Russian MID reported in 2021. The source is notable because it shows DPRK linked KONNI operators adapting trusted administrative software rather than relying only on document lures.