ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics

ScarCruft, also known as APT37, has been observed delivering RokRAT malware in a campaign named Operation HanKook Phantom that targets South Korean academics and related sectors. According to Seqrite Labs, the attackers appear to be aiming for intelligence gathering and long-term espionage, with targets including individuals linked to the National Intelligence Research Association such as academic figures, former government officials, and researchers.

The initial spear-phishing email lures recipients with a subject: “National Intelligence Research Society Newsletter—Issue 52” and a ZIP attachment containing an LNK file masquerading as a PDF, which, when opened, drops RokRAT. RokRAT is described as capable of collecting system information, executing commands, enumerating the file system, capturing screenshots, and downloading additional payloads, with exfiltrated data sent to Dropbox, Google Cloud, pCloud, and Yandex Cloud.

Seqrite also identified a second campaign in which the LNK loader triggers a PowerShell script, dropping a decoy Word document and a obfuscated batch file that deploys a dropper to steal data while concealing network traffic as a Chrome file upload. The lure document in this instance is a Kim Yo Jong statement dated 28 July, rejected Seoul’s reconciliation efforts.