North Korean BLUELIGHT Special: Inky Squid Deploys RokRAT
Summary: Volexity found two malware families on a single system belonging to a frequent target of North Korean actors: BLUELIGHT, loaded via a full Python 2.7 install and a Scheduled Task, and RokRAT, deployed less than 10 minutes later through a parallel Ruby-based loader. The RokRAT payload used the victim's hostname to decrypt its embedded data, so it would fail on any other machine, and it communicated with PCloud, Yandex, Dropbox, and Box using embedded API keys.
What's compelling: The user ran four popular antivirus programs before contacting Volexity and none detected either malware family, because the payloads stayed encoded on disk and were only visible in memory. A sample compiled to run on one hostname, with command and control riding on legitimate cloud services, leaves signature scanning and network monitoring little to work with.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026