North Korean state-sponsored hacker group ScarCruft used RokRAT malware against unspecified Korean-speaking individuals beginning in July 2022

EuRepoC

North Korean state-sponsored hacker group ScarCruft started using oversized LNK files to deliver RokRAT malware against unspecified Korean-speaking individuals beginning in early July 2022, according to technical reports of Israeli IT security company Check Point Research and South Korean security firm Ahnlab. In addition to the use of RokRAT, the threat actors deployed GOLDBACKDOOR and the commercial RAT Amadey, in a potential effort to disguise their motivation.