Konni, a North Korean threat group, targeted numerous Russian embassy diplomates during the winter holidays with infected email chains celebrating New Year’s Eve. Since December 20th, threat actors have been operating this malicious campaign as well as masking the malicious “.zip” attachments as New Year’s festivities. The ZIP archive possessed an infected Windows screensaver file (.scr) that, when executed, installs the Konni RAT allowing for full remote access of the compromised device. From here, Konni threat actors can send arbitrary commands to the infected device as well as dump additional payloads and modify system settings. Thus far, a majority of the emails sending these malicious emails originate from a “@mid[.]ru” domain, with the sender pretending to be a part of the Russian Embassy in Syria. While attacks were targeted specifically to the Russian Embassy in Indonesia, it is possible that additional undisclosed attacks occurred in surrounding regions at other embassies. CTIX is continuing to monitor any additional developments and will provide updates accordingly.