Loading story…
Researchers reported an ongoing phishing campaign dubbed STIFF#BIZON targeting high-value organizations in the Czech Republic, Poland, and other European countries, with activity primarily linked to North Korean threat group APT37. The operation delivers the Konni RAT through archive-based lures containing a Word document and a malicious shortcut file, giving attackers remote shell access, credential theft capability, screenshot capture, persistence, and privilege escalation on compromised Windows systems.
The intrusion chain uses the shortcut file to extract a Base64-encoded PowerShell payload from the DOCX, establish command-and-control communications, and retrieve additional malware components, including a decoy document and a VBS persistence mechanism. Later stages deploy CAB archives and DLLs that replace legitimate Windows service libraries such as wpcsvc to run commands with elevated privileges; researchers said the tooling and tradecraft align with APT37, although some infrastructure overlaps with past APT28/Fancy Bear activity, leaving open the possibility of false-flagging or attribution ambiguity.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Securonix Threat Labs uncovered and analyzed an ongoing phishing-led campaign dubbed STIFF#BIZON targeting high-value organizations in the Czech Republic, Poland, and other European countries. The campaign used Konni RAT and was primarily attributed to the North Korean threat group APT37, while researchers also noted possible infrastructure overlaps with APT28/FancyBear.
The references state that the Konni remote access trojan has been associated with North Korean cyber operations since 2014. This historical association provides context for the later STIFF#BIZON attribution to APT37.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcesecuronix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT37, also tracked as **ScarCruft/RedEyes**, has continued delivering the **RokRAT** backdoor through spear-phishing campaigns that use malicious `.lnk` shortcut files, often packaged in ZIP or ISO archives and disguised as certificates, conference invitations, or other South Korea-focused policy and security documents. Researchers reported that the LNK files launch hidden `cmd` and PowerShell chains to extract decoy files, stage payloads from locations such as `%public%`, and retrieve additional components from cloud storage including **OneDrive** and **Dropbox**. The activity has primarily targeted South Korean users, especially people involved in North Korea-related issues, unification, military, education, and activist communities, while earlier RokRAT operations also used malicious HWP documents exploiting `CVE-2013-0808`. Once executed, RokRAT performs host reconnaissance, steals credentials and other user data, captures screenshots and process information, executes attacker commands, and can download further malware, while hiding command-and-control and exfiltration traffic inside trusted cloud services such as **pCloud**, **Yandex**, **Dropbox**, **OneDrive**, and previously **Twitter** and **Mediafire**. Multiple reports said the malware uses in-memory or fileless execution, anti-analysis checks, and HTTP headers masquerading as **Googlebot**, complicating detection by signature-based tools. Analysts linked the campaigns to APT37 through recurring malware code, infrastructure patterns, lure themes, and tradecraft, and noted that the group shifted from document-based delivery to LNK-driven infection chains after macro-blocking changes made older techniques less reliable.
Aug 15, 2026
Researchers reported that **APT37** targeted Korean users with spear-phishing emails posing as urgent Microsoft Account Team messages and cybersecurity advisories, delivering ZIP archives that contained malicious `.lnk` files. The shortcut files abused native Windows tools including `cmd`, `PowerShell`, and `curl.exe` to fetch a decoy document and staged payloads, ultimately installing **NarwhalRAT**, a Python-based remote access trojan compiled from Python code. Genians linked the activity to Korea-focused infrastructure and artifacts, including references to `naverwhale`, KakaoTalk-related handling, and Korean relay servers. Once installed, NarwhalRAT established persistence through a scheduled task disguised as a Microsoft task, performed anti-VM checks, and enabled broad surveillance and control functions such as keylogging, screen capture, microphone recording, file transfer, USB data collection, and remote command execution. The malware used a dual command-and-control design that combined Korean relay domains with the **pCloud API** as a dead-drop resolver, complicating detection and tracking. Researchers urged defenders to strengthen EDR coverage for suspicious LNK-to-PowerShell execution chains, unusual scheduled task creation, unexpected `curl.exe` activity, and silent Python execution.
Jul 12, 2026
A targeted spearphishing campaign dubbed **Operation Capsule Vault** used genuine materials from a real academic event to lure researchers, policy workers, and academics into opening malware. Victims were sent a Dropbox link to a malicious ISO image containing a `PIF` executable disguised as a PDF seminar booklet; when opened, it displayed a legitimate decoy document while silently extracting shellcode and launching a multi-stage loader based on **`EMBED_PAYLOAD_v2`**. The shellcode restored and injected a final x64 **RokRAT** payload into `explorer.exe`, where it performed system reconnaissance, file collection, and screen-capture functions while communicating with command-and-control infrastructure over **Dropbox, pCloud, and Yandex Cloud**. Researchers tied the activity to the broader RokRAT cluster through code similarities, reused cloud-C2 patterns, boundary strings, and reused Yandex OAuth-related infrastructure, and assessed the operation as **highly likely linked to APT37**.
Jul 17, 2026