South Korean Lures Used to Deploy ROKRAT Malware

The North Korean threat actor recognised as APT37 has been noticed transforming deployment solutions and employing South Korean overseas and domestic affairs-themed lures with archives containing Windows shortcut (LNK) information that initiate ROKRAT an infection chains.

“Our results recommend that different multi-phase infection chains applied to at some point load ROKRAT have been utilized in other attacks, leading to the deployment of additional applications affiliated with the same actor,” described Examine Level Investigation (CPR) in an advisory released on Monday. “Those equipment contain a further personalized backdoor, Goldbackdoor, and the commodity malware Amadey.”

The security scientists clarified that ROKRAT an infection chains, very first spotted initially in 2017, historically included a destructive Hangul Phrase Processor (HWP) doc with an exploit or a Microsoft Word document with macros. 

“While some ROKRAT samples still use these techniques, we have observed a shift to delivering ROKRAT with LNK files disguised as legitimate files,” CPR wrote. “This change is not unique to ROKRAT but signifies a larger development that turned pretty well-liked in 2022. In July of that 12 months, Microsoft commenced blocking macros in Business office purposes by default in an hard work to decrease the distribute of malware.”

Go through more on submit-macro assaults: Hackers Change Strategies for New Article-Macro Period

Technically, ROKRAT predominantly focuses on running more payloads designed for facts exfiltration. 

“It depends on cloud infrastructure for C&C functions, which includes DropBox, pCloud, Yandex Cloud, and OneDrive,” CPR wrote in the advisory. “ROKRAT also collects data about the machine to avert additional an infection of unintended victims.”

More, the advisory clarifies that there are motives powering ROKRAT being largely unchanged in the final few decades.

“This can be attributed to its slick use of in-memory execution, disguising C&C conversation as potentially legitimate cloud interaction, and further levels of encryption to hinder network analysis and evade network signatures. As a final result, there are not a good deal of a short while ago printed content about ROKRAT.”

The CPR advisory will come times following Mandiant industry experts warned of an additional APT related with North Korea: APT43. 

Some parts of this article are sourced from:
www.infosecurity-magazine.com