Deep analysis of the IEND trojan family from steganographic delivery through kernel exploitation to persistent backdoor. Covers the rt_module C2 protocol, security.jar root exploit retrieval, CsKaitno.d userspace orchestrator, 10 kernel exploit binaries (4 CVEs), JNI backdoor persistence, and the embedded modular C2 task framework. All cryptographic protocols fully reversed. All C2 domains decoded. Live infrastructure probed 2026-03-09.
Table of Contents