InkySquid

InkySquid, also known as ScarCruft and APT37, is a threat actor believed to be associated with North Korea. This group has been identified as the exclusive user of RokRAT, a closed-source malware family. The actions of this group are monitored by cybersecurity firms such as Volexity, which uses the name InkySquid to refer to this particular actor. The activities of InkySquid have been linked to cyber threats and malicious actions, posing significant security concerns for targeted systems. The attribution of the activity to InkySquid is based on the unique patterns and tools associated with their operations. One notable tool is RokRAT, a backdoor malware that was previously attributed to ScarCruft/APT37, now known as InkySquid. This malware is not openly available and is believed to be used exclusively by this group, further supporting the attribution. Volexity's tracking and analysis of InkySquid's activities have provided substantial evidence linking the threat actor to the malicious activities described. Their use of specific malware like RokRAT, coupled with distinct operational patterns, has led to the broad consensus in the cybersecurity community about their identity and activities. As such, InkySquid represents a significant cybersecurity threat with potential ties to state-sponsored activities.