{
  "name": "Analysis of APT Group's Use of Malicious LNK Files to Deliver RokRat Attack",
  "slug": "analysis-of-apt-groups-use-of-malicious-lnk-files-to-deliver-rokrat-attack",
  "description": "The report details a recent cyber attack campaign by the APT-C-28 (ScarCruft) group, known for targeting organizations in Korea and Asia. The campaign utilized a malicious LNK file disguised as a document related to a 'North Korean Human Rights Expert Debate' to deliver the RokRat remote access trojan. When executed, the LNK file deployed a series of PowerShell scripts to download and execute the encrypted RokRat payload from a Dropbox link. Detailed analysis of the attack flow and malware components is provided, highlighting the group's persistent use of cloud services and evolving evasion techniques.",
  "published": "2024-04-29T16:40:09+00:00",
  "created_at": "2024-04-29T16:40:09+00:00",
  "modified_at": "2024-05-01T21:06:44+00:00",
  "created_at_opencti": "2024-04-29T16:40:09+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "apt",
    "cloud",
    "korea",
    "lnk",
    "rokrat"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "a9cbb1927b391173265ff7a4fdefed59afeddd5b245a2a58c2637b01f87f6119"
      },
      {
        "id": "",
        "name": "5237d0498685869d7788406a998e58c829587a1a604106cce7d4042316351e3a"
      },
      {
        "id": "",
        "name": "3fd02c7057ef1324ad74714a7fc4b00ac338cfb172a788d98e5a781548b8f027"
      }
    ],
    "malware": [
      {
        "id": "df02a7ff-d258-46c0-87a1-745be7c680b4",
        "name": "ROKRAT - S0240",
        "slug": "rokrat-s0240"
      }
    ],
    "intrusion_sets": [
      {
        "id": "bd64526a-ef5c-4493-b69f-fd21607a5b40",
        "name": "APT-C-28 (ScarCruft)",
        "slug": "apt-c-28-scarcruft"
      }
    ],
    "attack_patterns": [
      {
        "id": "4537eb7a-e017-4f29-b406-4d48249e3c00",
        "name": "T1096"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA%3D%3D&mid=2247498025&idx=1&sn=336c94786f14060ae5c583dc8c77370b&chksm=f9c1ca20ceb64336d678e5265df8264b81625947557b3ab882ec7f362bdf384ffe42e382ae8a&scene=178&cur_album_id=1955835290309230595",
    "https://otx.alienvault.com/pulse/662fe9890daf0672d674c778"
  ]
}