ROKRAT

Executive Summary

ROKRAT is a sophisticated cloud‑based RAT used by APT37 to gain persistent remote control over Windows systems in South Korea. It employs encrypted HTTPS C2 channels, keylogging, and credential theft capabilities to exfiltrate sensitive data and facilitate lateral movement within victim networks. The malware’s modular architecture and use of stealthy persistence mechanisms make it a high‑risk threat for targeted organizations.

ROKRAT is a cloud‑based Remote Access Trojan (RAT) developed for the APT37 threat actor, an advanced persistent threat group that has operated in South Korea since at least 2016. The malware functions as a fully featured remote shell, providing attackers remote control over infected Windows endpoints and enabling credential harvesting, data exfiltration, and lateral movement inside corporate networks. The payload leverages encrypted HTTPS traffic to connect to a command‑and‑control (C2) infrastructure hosted in the cloud, which helps it evade signature‑based defenses and blend in with legitimate web traffic. ROKRAT’s modular design includes keylogging, screenshot capture, process injection, and DLL hijacking components that facilitate persistence and stealth. APT37 has deployed ROKRAT across multiple campaigns targeting South Korean governmental agencies, military units, and private sector firms. The group’s use of the tool appears to focus on gathering privileged credentials, sensitive business data, and strategic information for intelligence collection or sabotage.

Key Capabilities

• Remote desktop control via VNC/remote GUI
• Encrypted HTTPS command‑and‑control communications
• Keylogging and screenshot capture
• Process injection and DLL hijacking
• Credential dumping (hashes and plaintext)
• Persistence through registry run keys or scheduled tasks
• Lateral movement via SMB/Windows Admin Shares
• Data exfiltration with obfuscated traffic

ATT&CK Techniques

Recommended Actions

• Implement endpoint detection and response (EDR) solutions that monitor for unusual outbound HTTPS connections to unknown cloud endpoints.
• Block or quarantine the ROKRAT binary and related modules on all Windows systems.
• Use host‑based firewalls to restrict inbound SMB/HTTP connections to approved hosts only.
• Patch vulnerable Windows components and enforce patch management policies.

Suggested Tags