Fractured Block is a campaign identified in 2018 that used the custom CARROTBAT dropper to deliver malware with lures focused on South and North Korea, cryptocurrency exchanges, digital assets, and political events. CARROTBAT samples appeared from March 2018 and delivered varying payloads, including the FTP-based SYSCON remote-access trojan. Related infrastructure overlapped with a December 2017 attack on a British government agency, although that earlier attack was not shown to have used CARROTBAT. At least 29 dropper samples and 12 decoy documents were identified.