North Korea’s APT37 deploys RokRAT in new phishing campaign against academics

On 1 September 2025, North Korea’s APT37 launched Operation HanKook Phantom, a phishing campaign using RokRAT to target academics, ex-officials, and researchers linked to the Association. The campaign relies on a fake “National Intelligence Research Society Newsletter – Issue 52” PDF and a disguised malicious LNK file, which, when executed, downloads a payload or runs commands to compromise the system.

The last-stage RokRAT malware is believed to be the handiwork of APT37 and delivers multi-stage infection via an LNK loader, PowerShell payloads, decoy PDFs and batch scripts to achieve fileless in-memory execution while fingerprinting hosts and enabling anti-VM evasion. According to Seqrite Labs, the malware also commands data exfiltration and remote execution, with C2 traffic shown to traverse Dropbox, pCloud and Yandex.

The operation targets academics, ex-government officials, and researchers, with aims including data theft, persistence and espionage. Seqrite notes that ScarCruft continues to employ highly tailored spear-phishing attacks and covert exfiltration techniques, leveraging cloud services for command and control.