AhnLab ASEC blog (asec.ahnlab.com)
AhnLab EDR Tracks and Responds against Link File (*.lnk) Distributing RokRAT · 2023-04-28
excerpt: AhnLab Security Emergency response Center (ASEC) has shared information regarding the RedEyes threat group (also known as APT37, ScarCruft), who distributed CHM Malware Disguised as Security Email from a Korean Financial Company last month. RokRAT Malware Distributed Through LNK Files (*.lnk): RedEyes (ScarCruft) The LNK file contains a PowerShell command and performs malicious behavior […] | attribution sentence: AhnLab Security Emergency response Center (ASEC) has shared information regarding the RedEyes threat group (also known as APT37, ScarCruft), who distributed CHM Malware Disguised as Security Email from a Korean Financial Company last month.