AhnLab attributes recent intrusions against Korean educational, manufacturing, and construction organizations to Andariel. The cases include compromise of an outdated Apache Tomcat server to deploy backdoors and proxy tools, continued use of Nestdoor, and a new Go-based backdoor the attacker named Dora RAT. Dora RAT supports reverse shell and file upload/download, including a variant loaded through a WinRAR SFX package where version.dll injects the payload into explorer.exe. The campaign also used keylogger, clipboard logger, infostealer, and proxy components, with some malware signed by a valid UK software-developer certificate.