LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0240: ROKRAT

ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to target victims in South Korea. APT37 has used ROKRAT during several campaigns from 2016 through 2021.[1][2][3]

EnterpriseS0240MalwareObject v2.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

ROKRAT matters because it represents a Windows remote access tool with collection, discovery, command-and-control, exfiltration, and stealth behaviors tied in ATT&CK to APT37 activity against South Korean victims from 2016 through 2021. For leaders, the value is not just naming the malware; it is testing whether the organization can spot a compromised endpoint that is quietly surveying the user, files, applications, registry, clipboard, screen, audio, and then moving data over web or web-service-based channels.

Executive priority

Prioritize ROKRAT as a readiness scenario for espionage-style intrusion response: endpoint visibility, user-executed malicious file controls, web egress governance, cloud/web-service monitoring, and evidence preservation. Security leaders should ask whether SOC and IR teams can reconstruct what data was accessed or captured, what credentials may have been exposed through keylogging, and whether web-based C2 or exfiltration would blend into approved business traffic. This is especially relevant to business continuity, legal/compliance evidence, and executive decision-making where sensitive communications, documents, or credentials are at risk.

Technical view

ATT&CK lists ROKRAT as Windows malware and relates it to behaviors spanning malicious file execution, Visual Basic and Native API execution, registry query/modification, process and window discovery, system/user/file discovery, process injection, obfuscation/deobfuscation, file deletion, collection from local system, keylogging, screen/audio/clipboard capture, ingress tool transfer, web protocol C2, bidirectional web-service communication, and exfiltration over the C2 channel. Because official detection text is not provided, teams should validate coverage behaviorally rather than relying on a malware name: correlate suspicious user-opened files with child process activity, registry access, process injection indicators, discovery bursts, unusual capture-related API/activity, tool downloads, and outbound web traffic patterns consistent with C2 and data movement.

Likely telemetry

  • Windows endpoint process creation, command-line, parent/child process, and script execution telemetry
  • Registry query and modification events
  • File creation, deletion, directory enumeration, and local data access telemetry
  • Endpoint detection signals for process injection, obfuscated payloads, and decode/deobfuscation activity
  • Clipboard, screen capture, audio device, and keylogging-related endpoint signals where available and lawful to collect

Detection direction

  • Build detections around the ATT&CK technique cluster, not just static indicators, because no official ATT&CK detection guidance is supplied for this object.
  • Correlate malicious-file execution with Visual Basic or Native API activity, registry changes, and immediate discovery commands or API-driven enumeration.
  • Tune for sequences: discovery of user/system/process/window/file context followed by collection behaviors and outbound web traffic.
  • Review web traffic to legitimate external web services for abnormal bidirectional patterns, while accounting for high false-positive potential from normal SaaS and browser use.
  • Validate endpoint visibility for capture behaviors such as keylogging, screen capture, audio capture, and clipboard access; these may be privacy-sensitive and unevenly logged.

Mitigation priorities

  • Reduce user-executed malicious file risk through attachment handling, user awareness, application control, and least-privilege execution controls.
  • Harden Windows endpoints for script, Visual Basic, registry, and native API abuse where operationally feasible.
  • Limit and monitor outbound web access, especially unsanctioned cloud or web-service communication paths that could support C2 or exfiltration.
  • Ensure endpoint controls can observe or block process injection, suspicious capture behaviors, and unauthorized tool transfer.
  • Apply least privilege and credential hygiene to reduce the value of keylogging and user discovery if an endpoint is compromised.
Additional notes and limits

This take is based on the official ATT&CK S0240 ROKRAT object, its external references, and supplied relationships. ATT&CK describes ROKRAT as a cloud-based RAT used by APT37 and lists multiple related techniques, but does not provide object-level tactics or detection guidance. Local validation should focus on whether the organization can observe the related behaviors on Windows systems and web egress paths.

No official detection text, aliases, labels, or object-level tactics were supplied. Technique relationships include platforms beyond Windows, but the malware object itself is supplied as Windows; this summary treats Windows as the supported platform for ROKRAT and uses broader technique platforms only as context. The supplied data does not support claims of current active exploitation, customer exposure, guaranteed detection, or attribution for any specific incident.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ROKRAT

ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to target victims in South Korea. APT37 has used ROKRAT during several campaigns from 2016 through 2021.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

30 rows
DomainIDNameRelationship / procedure
EnterpriseT1112Modify Registry

ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.[4]

EnterpriseT1123Audio Capture

ROKRAT has an audio capture and eavesdropping module.[5]

EnterpriseT1012Query Registry

ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.[2]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.[2]

EnterpriseT1056.001KeyloggingSub-technique

ROKRAT can use `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.[1][3]

EnterpriseT1106Native API

ROKRAT can use a variety of API calls to execute shellcode.[4]

EnterpriseT1622Debugger Evasion

ROKRAT can check for debugging tools.[2][6][4]

EnterpriseT1057Process Discovery

ROKRAT can list the current running processes on the system.[1][6]

EnterpriseT1070.004File DeletionSub-technique

ROKRAT can request to delete files.[6]

EnterpriseT1059.005Visual BasicSub-technique

ROKRAT has used Visual Basic for execution.[4]

EnterpriseT1555.004Windows Credential ManagerSub-technique

ROKRAT can steal credentials by leveraging the Windows Vault mechanism.[2]

EnterpriseT1480.001Environmental KeyingSub-technique

ROKRAT relies on a specific victim hostname to execute and decrypt important strings.[3]

EnterpriseT1041Exfiltration Over C2 Channel

ROKRAT can send collected files back over same C2 channel.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.[4]

EnterpriseT1115Clipboard Data

ROKRAT can extract clipboard data from a compromised host.[3]

EnterpriseT1027Obfuscated Files or Information

ROKRAT can encrypt data prior to exfiltration by using an RSA public key.[3][4]

EnterpriseT1497.001System ChecksSub-technique

ROKRAT can check for VMware-related files and DLLs related to sandboxes.[2][6][4]

EnterpriseT1083File and Directory Discovery

ROKRAT has the ability to gather a list of files and directories on the infected system.[5][6][3]

EnterpriseT1105Ingress Tool Transfer

ROKRAT can retrieve additional malicious payloads from its C2 server.[1][6][3][4]

EnterpriseT1140Deobfuscate/Decode Files or Information

ROKRAT can decrypt strings using the victim's hostname as the key.[3][4]

EnterpriseT1102.002Bidirectional CommunicationSub-technique

ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.[1][5][3]

EnterpriseT1113Screen Capture

ROKRAT can capture screenshots of the infected system using the `gdi32` library.[1][7][5][6][4]

EnterpriseT1033System Owner/User Discovery

ROKRAT can collect the username from a compromised host.[4]

EnterpriseT1055Process Injection

ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.[4]

EnterpriseT1082System Information Discovery

ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.[1][7][5][6][3][4]

EnterpriseT1010Application Window Discovery

ROKRAT can use the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.[1]

EnterpriseT1005Data from Local System

ROKRAT can collect host data and specific file types.[6][3][4]

EnterpriseT1204.002Malicious FileSub-technique

ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.[4]

EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

ROKRAT can send collected data to cloud storage services such as PCloud.[4][3]

EnterpriseT1071.001Web ProtocolsSub-technique

ROKRAT can use HTTP and HTTPS for command and control communication.[1][6][4]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0067: APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Relationship explorer

All related ATT&CK context

uses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1123: Audio CaptureEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1622: Debugger EvasionEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1555.004: Windows Credential ManagerEnterpriseuses · TechniqueT1480.001: Environmental KeyingEnterpriseuses · GroupG0067: APT37Enterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1115: Clipboard DataEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1102.002: Bidirectional CommunicationEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.3
Created
Modified
Raw hash
887050d01d7f5f20...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.3Current bundle887050d01d7f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  2. [2]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  3. [3]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  4. [4]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  5. [5]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  6. [6]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  7. [7]
    Talos ROKRAT 2

    Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.

    Open source URL
  8. [8]
    ROKRAT

    (Citation: Talos ROKRAT 2) (Citation: Talos Group123)

  9. [9]
    ROKRAT

    (Citation: Talos ROKRAT 2) (Citation: Talos Group123)

  10. [10]
    ROKRAT

    (Citation: Talos ROKRAT 2) (Citation: Talos Group123)

  11. [11]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  12. [12]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  13. [13]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  14. [14]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  15. [15]
    Talos ROKRAT 2

    Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.

    Open source URL
  16. [16]
    Talos ROKRAT 2

    Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.

    Open source URL
  17. [17]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  18. [18]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  19. [19]
    mitre-attackS0240
    Open source URL
  20. [20]
    mitre-attackS0240
    Open source URL
  21. [21]
    mitre-attackS0240
    Open source URL
  22. [22]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  23. [23]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  24. [24]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  25. [25]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  26. [26]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  27. [27]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  28. [28]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  29. [29]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  30. [30]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  31. [31]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  32. [32]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  33. [33]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  34. [34]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  35. [35]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  36. [36]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  37. [37]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  38. [38]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  39. [39]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  40. [40]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  41. [41]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  42. [42]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  43. [43]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  44. [44]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  45. [45]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  46. [46]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  47. [47]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  48. [48]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  49. [49]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  50. [50]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  51. [51]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  52. [52]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  53. [53]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  54. [54]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  55. [55]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  56. [56]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  57. [57]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  58. [58]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  59. [59]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  60. [60]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  61. [61]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  62. [62]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  63. [63]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  64. [64]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  65. [65]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  66. [66]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  67. [67]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  68. [68]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  69. [69]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  70. [70]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  71. [71]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  72. [72]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  73. [73]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  74. [74]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  75. [75]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  76. [76]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  77. [77]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  78. [78]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  79. [79]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  80. [80]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  81. [81]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  82. [82]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  83. [83]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  84. [84]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  85. [85]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  86. [86]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  87. [87]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  88. [88]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  89. [89]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  90. [90]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  91. [91]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  92. [92]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  93. [93]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  94. [94]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  95. [95]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  96. [96]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  97. [97]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  98. [98]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  99. [99]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  100. [100]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  101. [101]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  102. [102]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  103. [103]
    Talos ROKRAT 2

    Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.

    Open source URL
  104. [104]
    Talos ROKRAT 2

    Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.

    Open source URL
  105. [105]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  106. [106]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  107. [107]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  108. [108]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  109. [109]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  110. [110]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  111. [111]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  112. [112]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  113. [113]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  114. [114]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  115. [115]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  116. [116]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  117. [117]
    Talos ROKRAT 2

    Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.

    Open source URL
  118. [118]
    Talos ROKRAT 2

    Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.

    Open source URL
  119. [119]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  120. [120]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  121. [121]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  122. [122]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
  123. [123]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  124. [124]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  125. [125]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  126. [126]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  127. [127]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  128. [128]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  129. [129]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  130. [130]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  131. [131]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  132. [132]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  133. [133]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  134. [134]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  135. [135]
    Malwarebytes RokRAT VBA January 2021

    Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.

    Open source URL
  136. [136]
    NCCGroup RokRat Nov 2018

    Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.

    Open source URL
  137. [137]
    Talos ROKRAT

    Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use