APT trends report Q2 2023 (DPRK-related paragraph 5)

Kaspersky Securelist

With Microsoft disabling macro-embedded Office documents, threat actors began adopting new malware delivery methods, among them the ScarCruft group, which swiftly changed its initial infection tactics. The group operates two clusters named “Chinotto” and “RokRat”. While they have historically relied heavily on macro-embedded Word documents, they have continuously adopted other file formats, such as compiled HTML (.CHM) and Windows shortcut (.LNK) files. Furthermore, to evade Mark-of-the-Web (MOTW) mitigation, these files were delivered in archive file formats such as .RAR and .ZIP, or in optical disk image (.ISO) file formats. Despite continuous testing of the initial infection vectors, the actors persisted in using the same final payload. The Chinotto cluster still employs the Chinotto PowerShell script as a final payload, which is responsible for executing Windows commands on the victim’s computer. Similarly, the RokRat malware is delivered to the victim through a complicated infection procedure. This shows that the threat actor is putting a lot of effort into the initial infection vector, while still relying on the same final payload.