Loading story…
A targeted spearphishing campaign dubbed Operation Capsule Vault used genuine materials from a real academic event to lure researchers, policy workers, and academics into opening malware. Victims were sent a Dropbox link to a malicious ISO image containing a PIF executable disguised as a PDF seminar booklet; when opened, it displayed a legitimate decoy document while silently extracting shellcode and launching a multi-stage loader based on EMBED_PAYLOAD_v2.
The shellcode restored and injected a final x64 RokRAT payload into explorer.exe, where it performed system reconnaissance, file collection, and screen-capture functions while communicating with command-and-control infrastructure over Dropbox, pCloud, and Yandex Cloud. Researchers tied the activity to the broader RokRAT cluster through code similarities, reused cloud-C2 patterns, boundary strings, and reused Yandex OAuth-related infrastructure, and assessed the operation as highly likely linked to APT37.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
In its report, Genians assessed that Operation Capsule Vault was highly likely conducted by APT37. The attribution was based on overlaps with prior RokRAT activity, including reused Yandex infrastructure or tokens, cloud-C2 design, boundary strings, and code similarities with earlier operations.
Genians Security Center analyzed a targeted spear-phishing campaign it named Operation Capsule Vault that used real academic event materials to lure researchers, policy workers, and academics. The attack chain used a Dropbox-hosted ISO containing a PDF-lookalike PIF executable that displayed a decoy document while loading and injecting a RokRAT variant into explorer.exe.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcegenians.co.kr
Open sourcegenians.co.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT37, also tracked as **ScarCruft/RedEyes**, has continued delivering the **RokRAT** backdoor through spear-phishing campaigns that use malicious `.lnk` shortcut files, often packaged in ZIP or ISO archives and disguised as certificates, conference invitations, or other South Korea-focused policy and security documents. Researchers reported that the LNK files launch hidden `cmd` and PowerShell chains to extract decoy files, stage payloads from locations such as `%public%`, and retrieve additional components from cloud storage including **OneDrive** and **Dropbox**. The activity has primarily targeted South Korean users, especially people involved in North Korea-related issues, unification, military, education, and activist communities, while earlier RokRAT operations also used malicious HWP documents exploiting `CVE-2013-0808`. Once executed, RokRAT performs host reconnaissance, steals credentials and other user data, captures screenshots and process information, executes attacker commands, and can download further malware, while hiding command-and-control and exfiltration traffic inside trusted cloud services such as **pCloud**, **Yandex**, **Dropbox**, **OneDrive**, and previously **Twitter** and **Mediafire**. Multiple reports said the malware uses in-memory or fileless execution, anti-analysis checks, and HTTP headers masquerading as **Googlebot**, complicating detection by signature-based tools. Analysts linked the campaigns to APT37 through recurring malware code, infrastructure patterns, lure themes, and tradecraft, and noted that the group shifted from document-based delivery to LNK-driven infection chains after macro-blocking changes made older techniques less reliable.
Aug 15, 2026
North Korea-linked **APT37** (also tracked as **ScarCruft**) ran a multi-stage social engineering campaign that used fake Facebook personas to befriend targets, shifted conversations to Telegram, and then persuaded victims to install a trojanized version of **Wondershare PDFelement**. The lure claimed the software was needed to open encrypted military-related documents, with attacker-controlled accounts presenting themselves as contacts based in **Pyongyang** and **Pyongsong** to build credibility. When the tampered PDF viewer was executed, it launched encrypted shellcode, contacted command-and-control infrastructure hosted on a compromised legitimate website — including a site tied to the Seoul branch of a Japanese real estate service — and retrieved a JPG file that ultimately deployed the **RokRAT** remote access trojan. Researchers said the operation combined social engineering, legitimate software tampering, file-extension masquerading, abuse of trusted web infrastructure, and cloud-backed command and control through **Zoho WorkDrive**, showing that while RokRAT's core capabilities remain largely stable, its operators continue to refine delivery, execution, and evasion methods.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026