Genians attributes Operation Poseidon to Konni APT and details a targeted phishing chain against South Korean financial and North Korean human rights-related lures. The actor used legitimate advertising redirect structures, especially ad.doubleclick[.]net and earlier mkt.naver[.]com activity, to make malicious downloads appear as ordinary ad-click traffic before sending users to compromised WordPress infrastructure. Delivered ZIP archives contained LNK files that launched AutoIt scripts masquerading as PDF execution and loaded EndRAT or AutoItRAT variants in memory. Infrastructure reuse such as jlrandsons.co[.]uk and internal build-path artifacts tied to Poseidon provide technical evidence for linking related campaign activity and tracking Konni’s evolving initial access tradecraft.