Genians links increased Konni campaign activity with high confidence to the Kimsuky cluster and describes continued use of spear phishing against South Korean, Russian, diplomatic, security, finance, and cryptocurrency-related targets. The activity uses staged infection chains involving legitimate cloud services, FTP, LNK files, executable payloads, AutoIt-based defense-evasion tactics, and C2 infrastructure hosted through free web-hosting and domain services. The report correlates older Konni operations against Russian foreign-affairs themes with newer 2024 samples, including AsyncRAT variants tied to 159.100.13[.]216 and related domains such as duplikyservjc[.]cloud. Reused command patterns, victim-identification parameters based on hostnames, and shifting obfuscation techniques show a long-running campaign adapting its tooling while retaining recognizable infrastructure and tradecraft.