The LNK file contains embedded code that executes PowerShell commands to extract multiple components: a decoy HWPX document (a Korean document format), executable data files, and a batch script. While the security analyst, Mohamed Ezat from ZW01f noted that the attack begins with phishing emails containing ZIP attachments that conceal malicious LNK files masquerading as documents related to North Korean affairs or trade agreements. Their latest attack leverages ZIP file attachments containing hidden malicious LNK files that deploy the RokRat remote access trojan through a multi-stage process. It also includes multiple command functions that enable attackers to execute remote commands, scan drives, collect files, and download additional payloads, making it a versatile tool for espionage and data theft operations. The PowerShell commands look for the LNK file itself by searching for files with a specific size, then extracts data from predetermined offsets within the file structure. The first stage begins with the LNK file executing PowerShell code that extracts several files at specific byte offsets. Security researchers have identified a sophisticated attack campaign attributed to APT37, a North Korean state-sponsored hacking group also known as ScarCruft, Reaper, and Red Eyes. This technique helps the attackers evade detection by security solutions that focus solely on the initial file. For example, at offset 0x111E, it extracts 0xAD36 bytes and saves it as an HWPX file, which serves as a decoy document. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Upon execution, the LNK file initiates a sequence that extracts multiple payloads and saves them to the victim’s temporary directory. The shark.bat file launches PowerShell in a hidden window that reads elephant.dat from the temporary directory. The final payload, RokRat, is a sophisticated remote access trojan that collects detailed system information, including OS version, hardware details, running processes, and screenshots.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Mar 2025 19:55:08 +0000