lazarusholic

Everyday is lazarus.dayβ

#RokRAT

Tool/Malware

ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to target victims in South Korea. APT37 has used ROKRAT during several campaigns from 2016 through 2021.

Reports

2024-05-22
errbody
DPRK-Research
#Konni #Kimsuky #ScarCruft #RokRAT
2024-05-07
Ahnlab
LNK File Disguised as Certificate Distributing RokRAT Malware
#RokRAT #LNK #RedEyes
2024-04-23
Qihoo360
APT-C-28（ScarCruft）组织利用恶意LNK文件投递RokRat攻击的活动分析
#APT-C-28 #RokRAT #LNK
2024-04-23
Ahnlab
RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장)
#RokRAT #LNK #RedEyes
2024-04-03
Plainbit
Analysis of ROKRAT Malware inside LNK Malicious file from North Korea
#RokRAT #LNK
2024-03-27
Genians
APT37 그룹의 RoKRAT 파일리스 공격 증가
#APT37 #RokRAT #LNK
2024-03-21
SecuI
"북한지 기고문"을 위장하여 유포된 LNK 악성코드
#APT37 #RokRAT #LNK
2024-03-04
Sakai
북한 해킹 단체 APT37 Reaper(리퍼)에서 만든 악성코드-(안보칼럼) 반국가세력에 안보기관이 무기력해서는 안된다.zip(2024.02.22)
#APT37 #RokRAT
2024-03-04
安恒信息
APT37利用朝鲜政治话题针对韩国的攻击活动分析
#APT37 #RokRAT
2024-03-01
0x0v1
RE:archive | APT37's ROKRAT HWP Object Linking and Embedding
#APT37 #RokRAT
2024-02-26
qianlan
APT37组织主战远控武器RokRAT，更新迭代部分执行流程
#APT37 #RokRAT
2024-01-22
SentinelOne
ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals
#LNK #ScarCruft #RokRAT
2024-01-16
Genians
2024년 Webinar 안내장 사칭 APT 공격 포착
#APT37 #RokRAT #LNK
2023-10-05
S2W
Into the Cumulus: Scarcruft bolsters arsenal for targeting individual Android devices
#RokRAT #Cumulus #ScarCruft
2023-10-04
0x0v1
The evolution of North Korean Android spyware
#RambleOn #APT37 #RokRAT
2023-09-25
Sangfor
将目光对准高校——ScarCruft组织的新活动
#RokRAT #ScarCruft
2023-07-13
Qihoo360
APT-C-28（ScarCruft）组织针对能源方向投放Rokrat后门活动分析
#APT-C-28 #RokRAT
2023-07-11
Qianxin
云中谍影：Group123组织近期攻击活动分析
#Group123 #RokRAT #APT-Q-3 #LNK
2023-06-09
Sakai
북한 해킹 단체 Reaper(리퍼)에서 만든 악성코드-mfc100.dll(2023.5.29)
#TEMP.Reaper #RokRAT
2023-06-06
IBM
ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People's Republic of Korea (DPRK)
#ITG10 #RokRAT #LNK
2023-05-30
ThreatMon
Reverse Engineering RokRAT: A Closer Look at APT37's Onedrive-Based Attack Vector
#APT37 #RokRAT
2023-05-23
Genians
북한인권단체를 사칭한 APT37 공격 사례
#APT37 #LNK #RokRAT
2023-05-19
Qihoo360
APT-C-28（ScarCruft）组织利用恶意文档投递RokRat攻击活动分析
#APT-C-28 #RokRAT
2023-05-15
PolySwarm
Reaper Uses New TTPs to Drop RokRAT
#RokRAT #TEMP.Reaper #LNK
2023-05-01
Checkpoint
CHAIN REACTION: ROKRAT’S MISSING LINK
#APT37 #RokRAT #LNK
2023-04-28
网络安全研究宅基地
APT37针对韩国外交部下发RokRAT的窃密活动分析
#APT37 #RokRAT
2023-04-28
Ahnlab
EDR 제품을 통한 RokRAT 유포 링크 파일(*.lnk) 추적 및 대응
#RokRAT #LNK #RedEyes
2023-04-27
安恒信息
APT37针对韩国外交部下发RokRAT - 安恒威胁情报中心
#APT37 #RokRAT
2023-04-21
Ahnlab
링크 파일(*.lnk)을 통해 유포되는 RokRAT 악성코드 : RedEyes(ScarCruft)
#RokRAT #LNK #RedEyes
2023-01-16
GregLesewich
YARA-ing with MacOS
#YARA #APT37 #CloudMensis #RokRAT
2021-08-24
Volexity
North Korean BLUELIGHT Special: InkySquid Deploys RokRAT
#InkySquid #BLUELIGHT #RokRAT #DOGCALL
2021-07-14
S2W
Matryoshka : Variant of ROKRAT, APT37 (Scarcruft)
#APT37 #RokRAT #Matryoshka
2021-01-06
Malwarebytes
Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat
#APT37 #RokRAT
2018-09-21
v3lo
ROKRAT is Back
#RokRAT
2018-02-27
Carbonblack
Threat Analysis: ROKRAT Malware
#RokRAT
2018-01-16
CiscoTalos
Korea In The Crosshairs
#RokRAT #Group123
2017-11-28
CiscoTalos
ROKRAT Reloaded
#RokRAT
2017-04-03
CiscoTalos
Introducing ROKRAT
#RokRAT