Operation Poseidon: Konni APT Hijacks Google & Naver Ads for Malware

According to Genians Security Center, researchers have exposed Operation Poseidon, a sophisticated campaign attributed to the Konni APT group, which hijacks Google and Naver ads to deliver malware. The attackers weaponise legitimate ad-click redirection mechanisms, using valid redirect URLs from ad.doubleclick[.]net and mkt.naver[.]com so that a malicious link initially appears benign to security filters.

Instead of sending victims directly to a malicious site, users are bounced through a legitimate ad server and land on a compromised WordPress site hosting the payload. The campaign’s social engineering targets South Korean sectors, concentrating on financial data and human rights issues, with emails disguised as official notices to lure victims into downloading malicious ZIP archives.

Researchers noted that the EndRAT malware is loaded on the compromised site, and a build path left by the attacker—D:\\3_Attack Weapon\\Autoit\\Build_Poseidon – Attack\\client3.3.14.a3x—helps link the activity to Konni; this combination of techniques demonstrates a campaign that is difficult to block with simple firewall rules.