Unlike earlier versions that relied on cloud services for payload delivery, the latest attacks embed encrypted shellcode within malicious LNK files, reducing reliance on external servers likely flagged by security systems. PowerShell Script Activation: The LNK file invokes PowerShell to extract embedded files, including decoy documents, batch scripts, and encrypted RokRat shellcode. In-Memory Payload Decryption: A malicious batch script executes a secondary PowerShell script, applying XOR decryption to reveal the RokRat shellcode. The group, active since 2012, has shifted tactics to employ fileless malware delivery mechanisms for deploying its signature RokRat malware, targeting government personnel and corporations across South Korea and Asia. These emails contain ZIP attachments housing malicious LNK files disguised as documents related to North Korean affairs, diplomatic policies, or trade agreements. Thread Execution: The decrypted shellcode spawns a new thread to load the final RokRat payload, which connects to command-and-control (C2) servers while masquerading network traffic as Googlebot user agents. The 360 Advanced Threat Research Institute has uncovered a sophisticated cyber espionage campaign orchestrated by the North Korean-linked threat actor APT-C-28, also known as ScarCruft or APT37. The malware’s cloud-based infrastructure allowed operators to dynamically update payloads, but recent campaigns show a pivot toward embedding malicious components directly within phishing email attachments. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Security vendors’ rapid takedowns of malicious domains likely forced the group to minimize external dependencies. This evolution marks a significant escalation in the group’s ability to evade traditional security defenses while stealing military, economic, and political intelligence. Since 2016, RokRat has served as the group’s primary remote access tool (RAT), enabling persistent network infiltration and data exfiltration. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 20 Feb 2025 09:55:17 +0000