Introducing ROKRAT
Summary: Cisco Talos documented a spear-phishing campaign that sent HWP documents with embedded EPS objects exploiting CVE-2013-0808 to download and launch ROKRAT, using a compromised Yonsei University email address (kgf2016@yonsei.ac.kr) tied to the Korea Global Forum. ROKRAT uses Twitter, Yandex and Mediafire over HTTPS for command and control and exfiltration, skips Windows XP via GetVersion(), and generates fake traffic to Amazon and Hulu when analyst tools or sandbox processes are detected.
Key Takeaway: The command and control runs over Twitter, Yandex and Mediafire, which organizations cannot block globally because they are legitimate services, and Talos identified infected systems communicating with that C2 while writing the article.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2013-0808
- Related
- Korea In The Crosshairs Cyber Risks ·US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026