SCARCRUFT USES ROKRAT MALWARE IN OPERATION HANKOOK PHANTOM TARGETING SOUTH KOREAN ACADEMICS

Summary from the TLDR InfoSec newsletter

North Korean APT37 (ScarCruft) carried out Operation HanKook Phantom using spear-phishing emails with malicious LNK files disguised as PDFs to deliver RokRAT malware to South Korean research targets. The attack utilized fake newsletter lures from the National Intelligence Research Association, employing PowerShell scripts and fileless techniques to exfiltrate data via Dropbox, Google Cloud, and Yandex. This campaign shows APT37's focus on espionage against the South Korean government, research, and academic targets.