ENKI analyzed malware signed with a leaked Somansa code-signing certificate and assessed links to a North Korean APT cluster. The backdoor sample used command-and-control infrastructure under p-e[.]kr, a domain pattern the report says is frequently used by North Korean APT activity, and Rich Header analysis showed product and build identifiers overlapping malware build environments associated with North Korean, Chinese, and Iranian APT groups. The report frames the certificate leak as a supply-chain and trust-abuse risk because signed malware can evade user suspicion and some defensive controls while collecting system information, executing commands, and communicating with attacker infrastructure. Defenders should hunt for Somansa-signed suspicious binaries, the cited C2 indicators, and behaviors mapped to command execution, discovery, exfiltration, and defense evasion.