The Total Commander Remote Access Tool (RAT) was executed on an endpoint following the clicking of a malicious link. This has allowed the Leafminer group to potentially execute commands remotely and establish a foothold within the network.