S2W Talon analyzed Troll Stealer, a Go-based infostealer distributed from a Korean security program download flow that redirected users to installers for products such as TrustPKI and NX_PRNMAN. Only some installers on the site were modified, and the dropper ran the legitimate installer while loading a malicious DLL signed with a valid D2innovation certificate, suggesting certificate theft. Troll Stealer collects SSH, FileZilla, browser, C drive, system, and screenshot data before sending it to C2 infrastructure, and its GPKI-stealing capability points to interest in South Korean public or administrative systems. S2W assessed Kimsuky involvement because the malware shares collection commands and encryption patterns with AppleSeed and AlphaSeed, while noting that a closely related group could also be responsible.