S0240: ROKRAT

S0240: ROKRAT describes [ROKRAT](https://attack.mitre.org/software/S0240) is a cloud-based remote access tool (RAT) used by [APT37](https://attack.mitre.org/groups/G0067) to target victims in South Korea. [APT37](https://attack.mitre.org/groups/G0067) has used ROKRAT during several campaigns from 2016 through 2021.(Citation: Talos ROKRAT)(Citation: Talos Group123)(Citation: Volexity InkySquid RokRAT August 2021)

Executive priority

S0240: ROKRAT is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0240: ROKRAT by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0240: ROKRAT appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ROKRAT

ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to target victims in South Korea. APT37 has used ROKRAT during several campaigns from 2016 through 2021.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques30 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1112	Modify Registry	ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1123	Audio Capture	ROKRAT has an audio capture and eavesdropping module.CitationSecurelist ScarCruft May 2019
Enterprise	T1012	Query Registry	ROKRAT can access the `HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData` Registry key to obtain the System manufacturer value to identify the machine type.[2]
Enterprise	T1555.003	Credentials from Web BrowsersSub-technique	ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.[2]
Enterprise	T1056.001	KeyloggingSub-technique	ROKRAT can use `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.[1][3]
Enterprise	T1106	Native API	ROKRAT can use a variety of API calls to execute shellcode.CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1622	Debugger Evasion	ROKRAT can check for debugging tools.[2]CitationNCCGroup RokRat Nov 2018CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1057	Process Discovery	ROKRAT can list the current running processes on the system.[1]CitationNCCGroup RokRat Nov 2018
Enterprise	T1070.004	File DeletionSub-technique	ROKRAT can request to delete files.CitationNCCGroup RokRat Nov 2018
Enterprise	T1059.005	Visual BasicSub-technique	ROKRAT has used Visual Basic for execution.CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1555.004	Windows Credential ManagerSub-technique	ROKRAT can steal credentials by leveraging the Windows Vault mechanism.[2]
Enterprise	T1480.001	Environmental KeyingSub-technique	ROKRAT relies on a specific victim hostname to execute and decrypt important strings.[3]
Enterprise	T1041	Exfiltration Over C2 Channel	ROKRAT can send collected files back over same C2 channel.[1]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1115	Clipboard Data	ROKRAT can extract clipboard data from a compromised host.[3]
Enterprise	T1027	Obfuscated Files or Information	ROKRAT can encrypt data prior to exfiltration by using an RSA public key.[3]CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1497.001	System ChecksSub-technique	ROKRAT can check for VMware-related files and DLLs related to sandboxes.[2]CitationNCCGroup RokRat Nov 2018CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1083	File and Directory Discovery	ROKRAT has the ability to gather a list of files and directories on the infected system.CitationSecurelist ScarCruft May 2019CitationNCCGroup RokRat Nov 2018[3]
Enterprise	T1105	Ingress Tool Transfer	ROKRAT can retrieve additional malicious payloads from its C2 server.[1]CitationNCCGroup RokRat Nov 2018[3]CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1140	Deobfuscate/Decode Files or Information	ROKRAT can decrypt strings using the victim's hostname as the key.[3]CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1102.002	Bidirectional CommunicationSub-technique	ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.[1]CitationSecurelist ScarCruft May 2019[3]
Enterprise	T1113	Screen Capture	ROKRAT can capture screenshots of the infected system using the `gdi32` library.[1][4]CitationSecurelist ScarCruft May 2019CitationNCCGroup RokRat Nov 2018CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1033	System Owner/User Discovery	ROKRAT can collect the username from a compromised host.CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1055	Process Injection	ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1082	System Information Discovery	ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.[1][4]CitationSecurelist ScarCruft May 2019CitationNCCGroup RokRat Nov 2018[3]CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1010	Application Window Discovery	ROKRAT can use the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.[1]
Enterprise	T1005	Data from Local System	ROKRAT can collect host data and specific file types.CitationNCCGroup RokRat Nov 2018[3]CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1204.002	Malicious FileSub-technique	ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.CitationMalwarebytes RokRAT VBA January 2021
Enterprise	T1567.002	Exfiltration to Cloud StorageSub-technique	ROKRAT can send collected data to cloud storage services such as PCloud.CitationMalwarebytes RokRAT VBA January 2021[3]
Enterprise	T1071.001	Web ProtocolsSub-technique	ROKRAT can use HTTP and HTTPS for command and control communication.[1]CitationNCCGroup RokRat Nov 2018CitationMalwarebytes RokRAT VBA January 2021

Associated objects

Groups, software, and campaigns

G0067: APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 2.3
Created: Oct 17, 2018, 00:14 UTC (UTC+00:00)
Modified: Apr 25, 2025, 14:43 UTC (UTC+00:00)
Raw hash: 887050d01d7f5f20...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	2.3	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Current bundle	`887050d01d7f…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.3	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Older bundle	`887050d01d7f…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.3	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Older bundle	`887050d01d7f…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Talos ROKRAT
Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.
Open source URL
[2]
Talos Group123
Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
Open source URL
[3]
Volexity InkySquid RokRAT August 2021
Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.
Open source URL
[4]
Talos ROKRAT 2
Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.
Open source URL
[5]
ROKRAT
(Citation: Talos ROKRAT 2) (Citation: Talos Group123)
[6]
mitre-attackS0240
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use