Microsoft’s implementation of default macro blocking across Office documents has prompted North Korean state-sponsored threat operation Scarcruft, also known as APT37, Nickel Foxcroft, RedEyes, InkySquid, Ricochet Chollima, and Reaper, to leverage oversized LNK files to facilitate RokRAT malware delivery since last July, according to The Hacker News. Scarcruft has been launching spear-phishing attacks using LNK files to trigger multi-stage infection sequences that would eventually result in infections with the RokRAT malware, also known as DOGCALL, as well as its Android and macOS variants, dubbed RambleOn and CloudMensis, respectively, a report from Check Point showed.

Read full article on SC Magazine