An ordinary email attachment can serve as the perilous gateway to a sophisticated attack chain when a meticulously crafted toolkit lurks behind a seemingly benign document. Recently, analysts at 360 Advanced Threat Research uncovered a novel operation orchestrated by APT-C-00. This notorious threat actor, also widely recognized as OceanLotus and APT32, has returned with enhanced vigor. In this latest endeavor, the collective deployed malicious disk images, circumvented traditional security mechanisms, and seamlessly established remote access to compromised systems.