Scar Cruft Uses RokRAT Malware in Operation Han Kook Phantom Targeting South Korean Academics

Summary: Seqrite Labs codenamed a North Korea-linked ScarCruft (APT37) phishing campaign Operation HanKook Phantom, targeting academics, former government officials, and researchers tied to the National Intelligence Research Association. The spear-phishing email carries a ZIP archive with a Windows shortcut disguised as a PDF that shows a newsletter decoy while dropping RokRAT, which collects system information, runs commands, enumerates files, captures screenshots, and downloads payloads, exfiltrating data through Dropbox, Google Cloud, pCloud, and Yandex Cloud.
Bottom line: The exfiltration runs over four legitimate cloud services - Dropbox, Google Cloud, pCloud, and Yandex Cloud - so the traffic leaving a compromised academic or research host looks like ordinary file sync rather than an intrusion.

Read the original at The Hacker News ↗

Topics: Cloud Security
Related: Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026
New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026
Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage Cyber Risks ·