ROKRAT

RokRAT is a form of malware that has been utilized in cyber-espionage campaigns primarily targeting South Korean entities. It is typically delivered via phishing emails containing ZIP file attachments, which contain LNK files disguised as Word documents. When the LNK file is activated, a PowerShell script is executed, opening a decoy document to initiate the download process of RokRAT from cloud applications such as OneDrive. In recent RokRAT-related files analyzed by X-Force, instead of a ZIP file, Optical Disc Image files (ISO) were found containing LNK files with slightly modified PowerShell scripts and Hangul Word Processor decoy documents (HWP). The group behind these attacks, known as APT37 or ScarCruft, has consistently used RokRAT in their operations, including a notable attack exploiting a 1-click WPS Office bug to deliver the malware without any user interaction. The group has been particularly active against South Korean media and research organizations, delivering RokRAT via malicious documents. Interestingly, APT37 also targeted a trading company linked to Russia and North Korea using a novel phishing attack chain that culminated in the delivery of RokRAT. In one specific campaign, two oversized LNK files named "inteligence.lnk" and "news.lnk" were used. These LNK files, when opened, execute PowerShell code which extracts a decoy PDF document and fetches a hex-encoded file from the cloud. This process goes through two more shellcode stages before ultimately executing the Windows executable payload without any disk involvement, deploying RokRAT. The group's activities seem aligned with the efforts of North Korea's Ministry of State Security (MSS), indicating an intelligence collection motive. The SentinelLabs report suggests that RokRAT will continue to be at the center of cybersecurity targeting efforts in the foreseeable future.