APT19__2017__kingslayer-a-supply-chain-attack.pdf

**KINGSLAYER — A SUPPLY CHAIN ATTACK:** RSA Research details a sophisticated supply‑chain compromise in which an event‑log analysis tool used by enterprise Windows system administrators was subverted at distribution (signed with a stolen code‑signing key) to deliver a remote code‑loading backdoor and a memory‑resident secondary payload (K2); the report provides timeline, technical analysis, YARA rules and IOCs, sinkholing/hunt activity, and detection/mitigation guidance.