AhnLab reported malware distribution targeting users of vulnerable Innorix Agent file-transfer client versions, specifically identifying exploitation of version 9.2.18.418 within the KISA-advised vulnerable range of 9.2.18.450 and earlier. The delivered backdoor attempted C2 connections and could collect victim PC information, capture screenshots, and create or execute files. AhnLab observed both C/C++ and .NET variants with similar functionality, including attempts to hide scheduled tasks using an AhnLab-related name and encoded communications using an XOR key previously documented in a 2017 CISA report. Representative indicators included Andardoor detections, multiple MD5 hashes, and C2 endpoints such as 4.246.144[.]112:443 and 139.177.190[.]243:443.