Andariel Hackers Target South Korean Institutes with New Dora RAT Malware

Andariel, a North Korea-linked APT, has been observed deploying a new Golang backdoor dubbed Dora RAT—alongside Nestdoor variants, a keylogger, an information stealer, and a SOCKS5 proxy—against educational, manufacturing, and construction targets in South Korea by abusing an outdated Apache Tomcat server; some Dora RAT binaries were distributed with a valid UK code-signing certificate and the activity ties into prior Andariel/Lazarus campaigns involving SmallTiger and DurianBeacon.