ITG10 is IBM Security X-Force’s designation for a threat group whose activity overlaps with APT37 and ScarCruft. X-Force publicly described the cluster in June 2023 after uncovering an April 2023 phishing campaign that delivered RokRAT through malicious Windows shortcut files and obfuscated PowerShell. The observed lures impersonated credible senders and referenced South Korean parliamentary committees, broadcasters, think tanks, energy projects, manufacturing, and supply chains. X-Force assessed that probable targets included South Korean government personnel, universities, researchers, journalists, dissidents, and organizations holding strategic, political, or military information concerning the Korean Peninsula. The campaign used ZIP or ISO containers, decoy documents, LNK files, scripts, and cloud-hosted payloads. RokRAT provided command execution, file transfer, data exfiltration, and keylogging capabilities, supporting an intelligence-collection objective aligned with North Korean interests.