North Korean state-sponsored threat actor ScarCruft, also known as APT37, Ruby Sleet, Ricochet Chollima, InkySquid, and RedEyes, has targeted media outfits and individuals knowledgeable in North Korean affairs in a new attack campaign deploying the RokRAT backdoor, The Hacker News reports. Attacks involved the delivery of emails purportedly from a member of a North Korea Research Institute that lured targets into opening a ZIP archive file, which included malicious Windows shortcut files for RokRAT backdoor deployment, a report from SentinelOne showed.

Source: SC Magazine