EndRAT

EndRAT, also referred to as EndClient RAT, is a remote access trojan associated in the provided reporting with the North Korean Konni APT. It was observed in Konni’s "Operation Poseidon" spear-phishing campaign, which used malicious links disguised as Google and Naver advertising URLs, ad-click redirection through domains such as ad.doubleclick[.]net, and compromised WordPress sites for malware distribution and command-and-control. The campaign used targeted lures impersonating North Korean human rights organizations and South Korean financial institutions, including financial notices such as transaction confirmations or wire transfer requests, to induce victims to download ZIP archives. Those archives contained an LNK file that executed an AutoIt script disguised as a PDF, which loaded EndRAT. The stated objective of the infection chain was exfiltration of sensitive information. Reporting in the content ties the malware to South Korean-focused targeting and more broadly to Konni activity. A developer build-path artifact was reportedly found in the malware: D:\3_Attack Weapon\Autoit\Build_Poseidon – Attack\client3.3.14.a3x, which researchers used as a campaign naming clue. High-confidence indicators and artifacts directly mentioned in the content include the aliases "EndClient RAT," delivery via AutoIt script masquerading as a PDF, ZIP/LNK-based delivery, use of compromised WordPress infrastructure, and ad-redirection abuse involving ad.doubleclick[.]net.