LNK File Disguised as Certificate Distributing RokRAT Malware

ASEC reports an active campaign targeting South Korean users with malicious .LNK shortcut files that execute PowerShell to extract embedded payloads and deploy the RokRAT backdoor (fileless execution via viewer.dat/search.dat/find.bat). The malware collects system and user information, can execute commands and delete startup items, and exfiltrates data to cloud storage services (pCloud, Yandex, Dropbox) using a Googlebot-disguised User-Agent; the report includes filenames, MD5 hashes, and threat actor email addresses as IoCs.