A new malware called CARROTBALL, used as a second-stage payload in targeted attacks, was distributed in phishing email attachments delivered to a U.S. government agency and non-US foreign nationals. The topic was geopolitical relations issues regarding North Korea. Palo Alto Networks’ Unit 42 analyzing a campaign between July and October 2019 noticed multiple malware families that are normally attributed to a threat group they refer to as KONNI. The malware was missing from more recent activity with overlapping TTPs.
Source: https://www.bleepingcomputer.com/news/security/us-govt-agency-hit-with-new-carrotball-malware-dropper/