ScarCruft Exploits Trusted Cloud Services and OLE Documents to Deliver Malware

ScarCruft has evolved from LNK/BAT-based DROKLINK tactics to embedding OLE-based droppers inside HWP documents to load ROKRAT in memory; researchers observed three variants (DLL side-loading, cloud downloader retrieving steganographic shellcode, and an in-memory executor) that use pCloud and Yandex APIs for C2 and data disguise, increasing evasion and forensic difficulty. Organizations should treat unsolicited HWP files with extreme caution and apply policies to detect or block abnormal OLE objects.