North Korea

Seqrite Uncovers APT37’s ‘HanKook Phantom’ Phishing Targeting South Korean Academics With RokRAT

The report describes LNK-based loaders using fileless PowerShell with cloud services for command-and-control.