The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia
Summary: Unit 42 documented a campaign it calls Fractured Block, in which a previously unreported dropper named CARROTBAT delivers lures themed on South Korea and North Korea, including cryptocurrency exchanges and political events. The researchers identified 29 unique CARROTBAT samples with compile timestamps from March to September 2018, carrying 12 confirmed unique decoy documents, with earlier samples delivering SYSCON and newer ones delivering OceanSalt.
What's compelling: The lures were built around cryptocurrency and North Korea diplomacy topics and reached a high-ranking individual in a British government agency, and Unit 42 suspects the CARROTBAT, SYSCON, KONNI and OceanSalt activity may all belong to one actor, though it says the evidence is not yet sufficient to claim that with certainty.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026