Wikipedia (English), accessed 2026-10-06
Spear-phishing campaign against South Korean government · January 2021
In January 2021 the group was found to be using a Trojan horse for a spear-phishing campaign that targeted the South Korean government.
Retrohunting APT37: VBA self decode technique to inject RokRat
Source entries (3)
Hackmageddon cyber attacks timelines (Paolo Passeri)
South Korean government · 06/01/2021
Researchers from Malwarebytes reveal the details of a campaign carried out by the North Korean group APT37, targeting the South Korean government via the RokRat trojan. [Date Occurred: From January 2020; Date Discovered: 12/7/2020]
Malwarebytes Labs / ThreatDown blog
Retrohunting APT37: VBA self decode technique to inject RokRat · 2021-01-05T17:00:00+00:00
The primary initial infection vector used by APT37 is spear phishing, in which the actor sends an email to a target that is weaponized with a malicious document.