Loading story…
Security researchers linked a new ROKRAT malware variant to the FreeMilk intrusion set after finding shared reconnaissance code, similar PDB path patterns, overlapping credential-theft functionality, and ties to the Freenki downloader. Cisco Talos said the ROKRAT sample was delivered through a malicious Hangul Word Processor (HWP) document themed around North Korean human rights and Korean reunification, then dropped c:\ProgramData\HncModuleUpdate.exe, injected shellcode into cmd.exe, and loaded the payload in memory. The malware used legitimate cloud services for command-and-control and included anti-sandbox, anti-debugging, screenshot capture, and browser credential theft targeting Internet Explorer, Chrome, and Firefox.
Palo Alto Networks Unit 42 had previously described FreeMilk as a highly targeted spear-phishing operation that hijacked legitimate email threads and exploited CVE-2017-0199 to infect selected victims with PoohMilk and Freenki. The campaign targeted organizations including a Middle Eastern bank, European trademark and intellectual property firms, an international sporting organization, and individuals with indirect ties to a country in Northeast Asia. Researchers said the actor emphasized stealth through customized decoy documents, required command-line arguments for malware execution, and showed links to earlier N1stAgent activity and a 2016 watering-hole attack, strengthening the assessment that the same actor or closely cooperating operators were behind both the ROKRAT and FreeMilk campaigns.
Get the infrastructure and lures behind it.
9 events from the most recent confirmed update back to the earliest known activity.
Volexity investigated a targeted compromise attributed to APT37/InkySquid in which attackers deployed the BLUELIGHT malware followed less than 10 minutes later by a customized RokRAT payload. The intrusion used Python- and Ruby-based scheduled-task loaders and cloud services including PCloud, Yandex, Dropbox, and Box for command and control and encrypted data exfiltration.
A malicious Microsoft Office document compiled in January 2020 was likely used to spear-phish South Korean government targets and deliver a RokRat variant attributed to APT37. The document used a VBA self-decoding macro, modified the VBOM registry setting if needed, injected shellcode into Notepad.exe, and downloaded the payload from a bit.ly link redirecting to Google Drive.
Talos found the November 2017 ROKRAT variant shared reconnaissance code, PDB path patterns, and browser credential theft code with earlier Evil New Years, FreeMilk, and Freenki activity, reinforcing that the same actor or closely cooperating actors were behind the operations.
Cisco Talos discovered a new version of ROKRAT in November 2017 delivered through a malicious Hangul Word Processor document targeting people interested in North Korea-related policy and human rights topics in South Korea.
The malicious HWP decoy used in the later ROKRAT campaign referenced a meeting in Seoul dated 1 November 2017 and was themed around North Korean human rights and reunification issues.
Unit 42 reported that PoohMilk was also used to deliver another malware family, N1stAgent, in June 2017, extending the activity associated with the same tooling.
Palo Alto Networks Unit 42 identified a limited spear-phishing campaign in May 2017 and named it FreeMilk. The campaign hijacked legitimate email threads and exploited CVE-2017-0199 to deliver the PoohMilk loader and Freenki downloader to selected victims worldwide.
Cisco Talos publicly introduced the ROKRAT malware family in a blog post, marking an earlier documented stage of the campaign before the later November 2017 variant. This establishes ROKRAT activity as known by April 2017.
Unit 42 linked the Freenki malware to an August 2016 watering-hole attack that exploited CVE-2016-0189 on an anti-government media website operated by defectors in the United Kingdom.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 40 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
volexity.com
Open sourceblog.malwarebytes.com
Open sourceattack.mitre.org
Open sourceblog.talosintelligence.com
Open sourceblog.talosintelligence.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceblog.talosintelligence.com
Open sourceresearch.nccgroup.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT37, also tracked as **ScarCruft/RedEyes**, has continued delivering the **RokRAT** backdoor through spear-phishing campaigns that use malicious `.lnk` shortcut files, often packaged in ZIP or ISO archives and disguised as certificates, conference invitations, or other South Korea-focused policy and security documents. Researchers reported that the LNK files launch hidden `cmd` and PowerShell chains to extract decoy files, stage payloads from locations such as `%public%`, and retrieve additional components from cloud storage including **OneDrive** and **Dropbox**. The activity has primarily targeted South Korean users, especially people involved in North Korea-related issues, unification, military, education, and activist communities, while earlier RokRAT operations also used malicious HWP documents exploiting `CVE-2013-0808`. Once executed, RokRAT performs host reconnaissance, steals credentials and other user data, captures screenshots and process information, executes attacker commands, and can download further malware, while hiding command-and-control and exfiltration traffic inside trusted cloud services such as **pCloud**, **Yandex**, **Dropbox**, **OneDrive**, and previously **Twitter** and **Mediafire**. Multiple reports said the malware uses in-memory or fileless execution, anti-analysis checks, and HTTP headers masquerading as **Googlebot**, complicating detection by signature-based tools. Analysts linked the campaigns to APT37 through recurring malware code, infrastructure patterns, lure themes, and tradecraft, and noted that the group shifted from document-based delivery to LNK-driven infection chains after macro-blocking changes made older techniques less reliable.
Aug 15, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026