Operation Capsule Vault: APT37 Weaponizes Real Academic Event Materials to Deliver RokRAT via ISO/Process Injection — Threadlinqs Intelligence
As of 2026-07-13, Operation Capsule Vault: APT37 Weaponizes Real Academic Event Materials to Deliver RokRAT via ISO/Process Injection is a high-severity malware threat attributed to APT37 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1285 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: APT37 · North Korea · ESPIONAGE
APT37 (ScarCruft) ran a spear-phishing campaign, 'Operation Capsule Vault,' impersonating the real 'Why Wonsan-Kalma Tourism Now?' academic forum held in Seoul to lure researchers, policy specialists,
Beginning June 22, 2026, APT37 (also tracked as ScarCruft, InkySquid, Reaper, Group123, Ricochet Chollima, TEMP.Reaper, APT-C-28) launched a targeted spear-phishing campaign against researchers, policy specialists, and academics working on North Korea-related and Wonsan-Kalma tourism-zone topics. The lure abused the legitimacy of a real academic conference (the 'Why Wonsan-Kalma Tourism Now?' forum, held in Seoul on June 12, 2026) by referencing genuine event materials in the phishing email, which directed victims to a Dropbox-hosted link.
The Dropbox link delivered an ISO disk image (a technique APT37 favors because ISO mounting bypasses Mark-of-the-Web browser/download warnings). Inside the ISO was a single file using a deceptive multi-extension filename pattern ('.pdf.pif.pdf.pif.pdf.pif') that exploited Windows Explorer's default behavior of hiding known file extensions, so the victim saw what appeared to be a PDF document while the actual file was a Windows PIF (Program Information File) executable.
When executed, the PIF functioned as a multistage loader built on an 'EMBED_PAYLOAD_v2' structure: a container format bundling (1) a benign decoy PDF displayed to the victim to preserve the illusion of a legitimate document, and (2) a shellcode blob (observed on disk as 'yanfirst64.bin'). The loader extracted and displayed the decoy PDF while separately restoring the shellcode into memory. The shellcode used a call-pop routine to dynamically resolve its own memory location (a common position-independent-code technique to defeat static base-address assumptions), then decrypted its embedded payload using a single-byte XOR key of 0x29 -- the same XOR key Genians has previously documented in RokRAT's JPEG-steganography loader chain, indicating shared tooling/codebase across APT37 campaigns.
Once decrypted, the shellcode enumerated running processes via CreateToolhelp32Snapshot, located explorer.exe, opened a handle to it with OpenProcess, allocated remote memory with VirtualAllocEx, wrote the RokRAT payload into that memory with WriteProcessMemory, and executed it via RtlCreateUserThread -- a classic remote process-injection chain that lets the final backdoor run under the cover of a trusted, always-running system process (explorer.exe) rather than the loader's own process, defeating simple process-tree-based detections.
The injected x64 RokRAT variant performed environment/host fingerprinting (OS version, hostname, username, executable metadata, SMBIOS identifiers) before establishing command and control. Consistent with RokRAT's long-standing design, the malware abused legitimate cloud storage/API services -- Dropbox (initial ISO hosting), pCloud, and Yandex Cloud -- as command channels and exfiltration destinations, blending malicious traffic with normal cloud-service usage to evade network-based detection. Researchers identified a hardcoded multipart form-data boundary string ('--wwjaughalvncjwiajs--') and a spoofed User-Agent of 'Googlebot/2.1' used in the malware's HTTP requests to cloud APIs, likely to blend into web-crawler traffic logs or bypass simplistic User-Agent filtering.
Core RokRAT capabilities observed/documented include: screenshot capture, file collection and drive/directory enumeration, process listing, arbitrary command execution issued by the operator, and on-command trace removal from temp directories and the Startup folder to reduce forensic footprint.
Genians Security Center's attribution to APT37 rests on several independent overlaps rather than a single indicator: (1) the same Yandex OAuth tokens and Yandex accounts previously observed in APT37's 'Operation Artemis' and other RokRAT campaigns were reused in this operation's C2 configuration; (2) the cloud-service C2 design (Dropbox/pCloud/Yandex triad) matches APT37's established RokRAT infrastructure pattern going back to at least 2016; (3) the malware's command-processing logic, string-decryption routine, and shellcode XOR-key scheme are consist
Weaknesses (CWE)
CWE-451, CWE-506
Target sectors: government administration, academia, think tanks, ngo, policy-research
Target regions: south korea, East Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
7 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1589, T1584.006, T1583, T1566.002, T1566.001, T1204.002, T1106, T1059.005, T1547.015, T1055.001