North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains

[silversurfer]

Content source

https://thehackernews.com/2023/05/north-koreas-scarcruft-deploys-rokrat.html

The North Korean threat actor known as ScarCruft started experimenting with oversized LNK files as a delivery route for RokRAT malware as early as July 2022, the same month Microsoft began blocking macros across Office documents by default.

"RokRAT has not changed significantly over the years, but its deployment methods have evolved, now utilizing archives containing LNK files that initiate multi-stage infection chains," Check Point said in a new technical report.

"This is another representation of a major trend in the threat landscape, where APTs and cybercriminals alike attempt to overcome the blocking of macros from untrusted sources."

North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains

ScarCruft, the North Korean threat group behind RokRAT malware, has adapted to the blocking of macros by using oversized LNK files.

thehackernews.com

 

[upnorth]

Reported as far back as 2017 and already then highly evasive.

Introducing ROKRAT

This blog was authored by Warren Mercer and Paul Rascagneres with contributions from Matthew Molyett. Executive Summary A few weeks ago, Talos published research on a Korean MalDoc. As we previously discussed this actor is quick to cover their tracks and very quickly cleaned up their...

blog.talosintelligence.com