Tencent's preserved Hermit report says the group continued APT activity against the Korean Peninsula while also targeting blockchain, cryptocurrency, financial, and diplomatic entities. The attack chain used spear-phishing Word documents with malicious macros that downloaded a second document, copied certutil as ct.exe, retrieved batch-script stages, decoded a CAB file, and installed victory.exe under the public documents path with registry persistence. Tencent identified victory.exe as Amadey-family malware that collected local and antivirus information before requesting an additional payload from C2, then described sp.exe as a Babyface RAT communicating with 5.252.198.93:7337. The report links the macro style, decoding method, scripts, and tooling to earlier Hermit activity and notes continued Syscon/Sandy backdoor activity.