ROKRAT

Description

ROKRAT is a remote access trojan used against Korean speaking targets, including North Korean defectors and human rights organizations, that abuses legitimate cloud services such as Dropbox, Google Drive, Yandex Disk, and Twitter for command and control. Its use of trusted cloud infrastructure makes its traffic blend into normal user activity.

Stats

First seen: April 2024
Last seen: September 2026

Also known as

RokratRokratlnk

MITRE ATT&CK techniques

30 techniques across 9 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.001Spearphishing Attachment

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.005Visual Basic
T1106Native API
T1204User Execution
- T1204.002Malicious File

TA0005 Stealth

T1027Obfuscated Files or Information
T1055Process Injection
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
- T1480.001Environmental Keying
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1622Debugger Evasion

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers
- T1555.004Windows Credential Manager

TA0007 Discovery

T1010Application Window Discovery
T1012Query Registry
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery

TA0009 Collection

T1005Data from Local System
T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture
T1115Clipboard Data
T1123Audio Capture

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
- T1102.002Bidirectional Communication
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel
T1567Exfiltration Over Web Service
- T1567.002Exfiltration to Cloud Storage

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

G0067APT37

Alert name variants

Alert Name	Engine
Shortcut.Trojan.Rokratlnk	ATP Sandbox Adv. Heuristics
Win32.Spyware.Rokrat	ATP Sandbox Adv. Heuristics
Win32.Trojan.Rokratlnk	ATP Sandbox Adv. Heuristics

Related families

InvisiMole QakBot Remcos Grandoreiro Metamorfo