APT37 Expands RokRAT Campaigns Through Malicious LNK Files and Cloud C2

APT37, also tracked as ScarCruft/RedEyes, has continued delivering the RokRAT backdoor through spear-phishing campaigns that use malicious .lnk shortcut files, often packaged in ZIP or ISO archives and disguised as certificates, conference invitations, or other South Korea-focused policy and security documents. Researchers reported that the LNK files launch hidden cmd and PowerShell chains to extract decoy files, stage payloads from locations such as %public%, and retrieve additional components from cloud storage including OneDrive and Dropbox. The activity has primarily targeted South Korean users, especially people involved in North Korea-related issues, unification, military, education, and activist communities, while earlier RokRAT operations also used malicious HWP documents exploiting CVE-2013-0808.

Once executed, RokRAT performs host reconnaissance, steals credentials and other user data, captures screenshots and process information, executes attacker commands, and can download further malware, while hiding command-and-control and exfiltration traffic inside trusted cloud services such as pCloud, Yandex, Dropbox, OneDrive, and previously Twitter and Mediafire. Multiple reports said the malware uses in-memory or fileless execution, anti-analysis checks, and HTTP headers masquerading as Googlebot, complicating detection by signature-based tools. Analysts linked the campaigns to APT37 through recurring malware code, infrastructure patterns, lure themes, and tradecraft, and noted that the group shifted from document-based delivery to LNK-driven infection chains after macro-blocking changes made older techniques less reliable.