ScarCruft Used HWP and CHM Lures to Deliver M2RAT and PowerShell Backdoors

The North Korea-linked ScarCruft group, also tracked as RedEyes and APT37, used multiple lure themes and file formats to target South Korean users with espionage malware. In one campaign, attackers weaponized Hangul Word Processor documents with the EPS flaw CVE-2017-8291, embedding malicious EPS content that executed code, dropped scripts, downloaded additional payloads, and launched malware through rundll32. A later AhnLab investigation found the group hiding an encoded PE payload inside a downloaded JPEG via steganography, then decoding a loader that established persistence through a Run key and used PowerShell and mshta before injecting a newly identified backdoor, M2RAT, into explorer.exe.

ScarCruft also shifted to CHM lures tied to the Fukushima wastewater issue, using social engineering to trigger JavaScript and an encoded PowerShell backdoor that could persist, receive commands, steal files, and manipulate the registry and scheduled tasks. Researchers said M2RAT expands the group’s collection capabilities with keylogging, screen capture, process control, file theft, and USB or document exfiltration, while earlier reporting also documented ScarCruft’s evolving tooling, including a Bluetooth harvester. The activity shows a sustained pattern of adapting delivery methods while maintaining a focus on intelligence collection from carefully selected victims in South Korea.