North Korean government hackers target individuals of interest, infosec professionals

SentinelLabs observed North Korean APT ScarCruft (linked to the Ministry of State Security) conducting phishing campaigns in Nov–Dec 2023 that targeted media organizations and high-profile experts and prepared a likely campaign aimed at cybersecurity researchers; victims who executed the phishing were targeted with the RokRAT backdoor, and researchers recovered planning/testing-phase malware using decoy technical reports, indicating continued strategic-intelligence collection and intent to target cyber defenders.