South Korean Lures Used to Deploy ROKRAT Malware

The North Korean danger actor regarded as APT37 has been noticed switching deployment procedures and making use of South Korean international and domestic affairs-themed lures with archives that contains Windows shortcut (LNK) data files that initiate ROKRAT an infection chains.

“Our conclusions advise that numerous multi-stage infection chains applied to ultimately load ROKRAT were used in other attacks, leading to the deployment of added tools affiliated with the exact same actor,” spelled out Look at Level Research (CPR) in an advisory published on Monday. “Those equipment include a different custom made backdoor, Goldbackdoor, and the commodity malware Amadey.”

The security scientists clarified that ROKRAT infection chains, very first noticed initial in 2017, historically concerned a malicious Hangul Phrase Processor (HWP) doc with an exploit or a Microsoft Word document with macros. 

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“While some ROKRAT samples continue to use these strategies, we have noticed a shift to providing ROKRAT with LNK information disguised as reputable files,” CPR wrote. “This shift is not exceptional to ROKRAT but signifies a larger craze that grew to become very popular in 2022. In July of that yr, Microsoft began blocking macros in Business office apps by default in an hard work to lessen the unfold of malware.”

Browse a lot more on publish-macro attacks: Hackers Alter Ways for New Publish-Macro Period

Technically, ROKRAT generally focuses on managing additional payloads created for facts exfiltration. 

“It relies on cloud infrastructure for C&C functions, which includes DropBox, pCloud, Yandex Cloud, and OneDrive,” CPR wrote in the advisory. “ROKRAT also collects info about the device to stop even more infection of unintended victims.”

Even further, the advisory clarifies that there are good reasons behind ROKRAT currently being typically unchanged in the previous several years.

“This can be attributed to its slick use of in-memory execution, disguising C&C conversation as likely reputable cloud communication, and extra levels of encryption to hinder network assessment and evade network signatures. As a outcome, there are not a good deal of not too long ago revealed articles about ROKRAT.”

The CPR advisory comes days right after Mandiant gurus warned of a different APT connected with North Korea: APT43.