RokRAT Malware Hides Behind Academic Event PDFs and Cloud Storage Links

Security Center has uncovered a targeted spear-phishing campaign, dubbed Operation Capsule Vault, that uses real academic event materials to deliver the RokRAT remote-access Trojan.

The activity is assessed as highly likely linked to the North Korea-aligned APT37 threat group. The campaign targeted people in research, policy, and academic sectors.

Attackers impersonated the distribution of materials for an actual conference, “Why Wonsan-Kalma Tourism Now?”, held at Seoul COEX on June 121212, 202620262026.

Rather than inventing a fake event, the operators reused publicly available event details, including its title, topic, and host information, making the lure appear credible to recipients.

RokRAT Abuses Academic PDFs

The ISO filename resembled a seminar-material booklet. Inside it was another file designed to look like a PDF document.

However, the file was actually a PIF (Program Information File), which modern Windows systems can execute.

Because Windows commonly hides extensions for known file types, a filename ending in .pdf.pif may appear to a victim as a harmless PDF.

Genians said the executable contained both a legitimate PDF decoy and a malicious payload.

When opened, it displays actual academic-event material, convincing the victim that the file is legitimate. At the same time, it silently extracts and runs malware in the background.

The loader uses an embedded payload format marked with the string EMBED_PAYLOAD_v2.

Its payload table includes two objects: the benign PDF and a shellcode component saved as yanfirst64.bin. The shellcode is restored entirely in memory, reducing disk artifacts that could expose the infection.

Researchers also found that the PIF file carried a build timestamp from October 202520252025, despite embedding material related to an event held in June 202620262026.

This discrepancy suggests the timestamp was likely manipulated to complicate forensic analysis. After decrypting the embedded shellcode with an XOR key of 0x29, the malware locates explorer.exe.

It injects its final payload into that legitimate Windows process. It uses APIs including CreateToolhelp32Snapshot, OpenProcess, VirtualAllocEx, WriteProcessMemory, and RtlCreateUserThread to allocate remote memory and create a malicious thread.

The malware can receive commands, capture screenshots, enumerate drives and processes, execute shell commands, and steal documents.

Its default file targets include .XLS, .DOC, .PPT, .TXT, .M4A, .AMR, .PDF, and .HWP. Some payloads run directly from memory, while others are written as %TEMP%KB400928_doc.exe, a filename previously associated with RokRAT activity.

Genians linked the campaign to APT37 based on code similarities to earlier RokRAT samples, a shared cloud-C2 design, reuse of Yandex infrastructure, and overlap with the group’s previously documented Operation Artemis activity. One Yandex account, philp. stwart, was also observed in earlier campaigns.

Organizations should monitor for ISO files delivered via cloud-sharing links, PIF executables masquerading as documents, unexpected remote thread creation in explorer.exe, and endpoint connections to cloud storage APIs following suspicious document execution.

Enabling visible file extensions and blocking or tightly controlling PIF execution can also reduce exposure.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post RokRAT Malware Hides Behind Academic Event PDFs and Cloud Storage Links appeared first on Cyber Security News.