ROKRAT

RokRAT is a Windows remote access trojan and backdoor family closely associated with the North Korea-linked threat group APT37, also tracked as ScarCruft. It is used primarily for espionage and information collection and has appeared across multiple targeted intrusion campaigns against South Korean and Korea-focused victims, including researchers, policy personnel, academics, activists, media figures, and other public-interest targets.

RokRAT commonly operates through multi-stage, memory-resident infection chains delivered via spearphishing and related social-engineering lures. Observed delivery methods include malicious shortcut files, document-themed executables disguised as PDFs, ISO images, weaponized HWP documents, and trojanized software installers. Several campaigns used decoy documents tied to real events or topical themes to reduce suspicion while hidden loaders decrypted shellcode and injected the final payload into legitimate Windows processes such as explorer.exe or dism.exe. RokRAT has also been deployed through DLL sideloading and steganography-based staging.

Once active, RokRAT fingerprints the host using operating system, user, computer, process, and SMBIOS-derived hardware information to build victim identifiers and profile infected systems. Its command set supports system reconnaissance, process and drive enumeration, screenshot capture, arbitrary command execution, recursive file collection, and execution of additional payloads from memory or disk. Document theft has repeatedly focused on common office and Korean-language formats, reflecting its espionage role. Some variants also include cleanup functions to remove artifacts and traces after tasking.

A defining characteristic of RokRAT is its abuse of legitimate cloud services for command-and-control and exfiltration. Observed variants have used Dropbox, pCloud, Yandex Cloud or Yandex Disk, and Zoho WorkDrive rather than conventional dedicated C2 servers. This cloud-centric design helps blend malicious traffic with normal enterprise use and complicates blocking and detection. Variants have also used spoofed crawler-like HTTP user agents and encrypted or obfuscated communications and payloads.

RokRAT samples and campaigns have shown repeated use of process injection, in-memory decryption, API hashing, anti-analysis checks, and other defense-evasion measures. Reported anti-analysis behavior includes virtualization and debugger checks, fileless execution patterns, and selective use of legitimate processes and trusted services to conceal activity. Across campaigns, RokRAT has remained one of APT37’s signature malware families, though later activity indicates the group has also experimented with other RAT families alongside or instead of RokRAT.