ROKRAT Reloaded
Summary: Cisco Talos discovered a new ROKRAT version delivered through a malicious HWP document posing as a lawyer's request tied to a November 1, 2017 Seoul meeting of a North Korean human rights group. The document drops an OLE object that decodes base64 content into c:\ProgramData\HncModuleUpdate.exe, a ROKRAT dropper that loads a PE payload into cmd.exe, and the variant adds Microsoft Vault credential theft plus embedded SQLite library code to browse Firefox and Chrome passwords.
Bottom line: Talos found the browser password stealer code is identical to that used in the FreeMilk campaign, down to the copied typo "IE Registery" - a code-level link that ties ROKRAT's author to that spear-phishing operation and signals the actor is now after credentials for follow-on compromises and personal accounts.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026