Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware

South Korean firm Genians attributes a targeted multi-stage campaign to Konni (North Korean actors) that begins with spear-phishing ZIP attachments containing LNK shortcuts. Execution of the LNK fetches an AutoIt-based RAT (EndRAT/EndClient) and additional RATs (RftRAT, Remcos), establishes persistence via scheduled tasks, steals internal documents, and leverages the victim's KakaoTalk desktop to selectively distribute malicious ZIP payloads to the victim's contacts, turning compromised users into propagation vectors.