North Korean Hackers Weaponize Fake Research to Deliver RokRAT Backdoor

SentinelOne researchers attribute a December 2023 campaign to North Korea–linked ScarCruft (APT37) that targeted media and North Korea experts by delivering ZIP files containing benign decoys alongside malicious LNK files and shellcode to stage the RokRAT backdoor; the actor used a legitimate threat-intelligence report as a decoy and appears to be experimenting with new infection chains and brand-impersonation techniques to refine targeting and evade detection.