Symantec reports that Springtail, also known as Kimsuky, distributed dropper malware disguised as an application from a known Korean public entity. The source says the operation abused a valid certificate and installed the Endoor backdoor after compromise. Endoor gives the attackers a foothold for collecting sensitive information from victims or deploying additional malware, with Symantec detections and WebPulse coverage listed for protection.