Operation Red Signature compromised a South Korean remote support provider's update server to deliver 9002 RAT to selected customer IP ranges. The attackers stole the vendor's code-signing certificate, signed malicious update files, and used the trusted update process to execute a DLL that decrypted and ran the RAT in memory. The payload connected to 66[.]42[.]37[.]101 and downloaded additional tools for Active Directory discovery, SQL password dumping, browser password recovery, Mimikatz activity, and exploitation of IIS 6 WebDAV via CVE-2017-7269. Trend Micro also observed a PlugX variant using the same C2 and infrastructure at 207[.]148[.]94[.]157, making the case important for defenders monitoring trusted software-update channels and post-compromise tooling.