sadasd

Konni 2019 campaign analysis: this report documents multiple 2019 Konni campaigns (linked to APT37) that use malicious macro-laden Word documents to launch a multi-stage infection chain which abuses certutil and living-off-the-land binaries, employs a Vault 7-derived token impersonation/UAC bypass for privilege escalation, achieves persistence by registering a malicious DLL as the COMSysApp service DLL, performs system reconnaissance (systeminfo, tasklist), and exfiltrates gathered data to FTP-based C2 servers; the report includes decoding routines, MITRE technique mappings and extensive IOCs (file hashes, IPs, domains).