RokRAT malware activity on Windows hosts
Malware Activity
Summary
Hide ▲
Show ▼
The RokRAT malware is being delivered through malicious LNK and PowerShell chains, giving operators control over infected Windows hosts and enabling cloud-based exfiltration. The payload can collect system information, execute arbitrary commands, enumerate files, capture screenshots, and download additional payloads. The infection chains use a ZIP archive and masqueraded PDF lure to trigger execution. Collected data is sent through Dropbox, Google Cloud, pCloud, and Yandex Cloud.
Related Happenings
Amnesia RAT retrieved from Dropbox for data theft and remote control
Malware Activity
H score29
First: 24.01.2026 13:09
Last: 24.01.2026 13:09
Sources 1
About this happening:
The Amnesia RAT payload is being staged from Dropbox, giving the operators a remote-access trojan that can steal data and control infected endpoints. It is the final s...
Amnesia RAT retrieved from Dropbox for data theft and remote control
Malware ActivityAbout this happening: The Amnesia RAT payload is being staged from Dropbox, giving the operators a remote-access trojan that can steal data and control infected endpoints. It is the final s...
AsyncRAT distribution via TryCloudflare, Dropbox, and WSH infection chain
Malware Activity
H score27
First: 14.01.2026 16:18
Last: 14.01.2026 16:18
Sources 1
About this happening:
A multi-stage phishing chain is distributing AsyncRAT through TryCloudflare tunnels and Dropbox ZIP links, creating a persistent Windows infection path that en...
AsyncRAT distribution via TryCloudflare, Dropbox, and WSH infection chain
Malware ActivityAbout this happening: A multi-stage phishing chain is distributing AsyncRAT through TryCloudflare tunnels and Dropbox ZIP links, creating a persistent Windows infection path that en...
Patchwork-linked StreamSpy Trojan adds WebSocket and HTTP C2
Malware Activity
H score23
First: 02.01.2026 15:52
Last: 02.01.2026 15:52
Sources 1
About this happening:
QiAnXin linked Patchwork/Maha Grass to StreamSpy, a previously undocumented Windows RAT delivered through OPS-VII-SIR.zip and Annexure.exe. The malware use...
Patchwork-linked StreamSpy Trojan adds WebSocket and HTTP C2
Malware ActivityAbout this happening: QiAnXin linked Patchwork/Maha Grass to StreamSpy, a previously undocumented Windows RAT delivered through OPS-VII-SIR.zip and Annexure.exe. The malware use...
Latest development: 07.01.2026 18:45
ReversingLabs identified pkr_mtsi as a flexible Windows malware packer and loader first seen on April 24 2025, used in large-scale malvertising and SEO-poisoning campaigns to distribute trojanized installers masquerading as legitimate software and deliver Oyster, Vidar, Vanguard Stealer and Supper.
UDPGangster backdoor deployed by MuddyWater
Malware Activity
H score22
First: 08.12.2025 08:46
Last: 08.12.2025 08:46
Sources 1
About this happening:
The MuddyWater group has deployed UDPGangster, a new backdoor that uses UDP C2 to control compromised systems and expand post-compromise access. The malware can exec...
UDPGangster backdoor deployed by MuddyWater
Malware ActivityAbout this happening: The MuddyWater group has deployed UDPGangster, a new backdoor that uses UDP C2 to control compromised systems and expand post-compromise access. The malware can exec...
Kimsuky HttpTroy spear-phishing campaign targeting South Korea
Campaign
H score32
First: 03.11.2025 12:42
Last: 03.11.2025 12:42
Sources 1
About this happening:
A Kimsuky spear-phishing operation delivered HttpTroy to a single victim in South Korea, giving the attackers a multi-stage path to remote control and persistence. The...
Kimsuky HttpTroy spear-phishing campaign targeting South Korea
CampaignAbout this happening: A Kimsuky spear-phishing operation delivered HttpTroy to a single victim in South Korea, giving the attackers a multi-stage path to remote control and persistence. The...
Timeline
-
01.09.2025 11:26 2 articles · 10mo ago
RokRAT is delivered through a malicious LNK phishing chain
Initial DisclosureSeqrite Labs identified Operation HanKook Phantom as a ScarCruft (APT37) phishing campaign against people associated with the National Intelligence Research Association in South Korea, using a ZIP archive with a Windows shortcut (LNK) masquerading as a PDF document to launch a decoy newsletter and drop RokRAT on infected Windows hosts. RokRAT can collect system information, execute arbitrary commands, enumerate the file system, capture screenshots, download additional payloads, and exfiltrate data through Dropbox, Google Cloud, pCloud, and Yandex Cloud.
Show sources
- ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics — thehackernews.com — 01.09.2025 11:26
- ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics — thehackernews.com — 01.09.2025 11:26