ScarCruft Abuses Legitimate Cloud Services for C2 and OLE-based Chain to Drop Malware

ScarCruft, a North Korean–backed APT, has evolved its intrusion methods by embedding malicious OLE objects in HWP documents to deploy the ROKRAT remote access trojan; the campaign leverages DLL side‑loading (examples: mpr.dll, credui.dll), in‑memory execution with a 0x29 XOR decryption, and abused commercial cloud services (pCloud, Yandex) for C2, with technical markers (ROR13 resolving and steganography-hosted shellcode) that tie these incidents to the group’s historical operations.