Beginning June 22, 2026, APT37 (also tracked as ScarCruft, InkySquid, Reaper, Group123, Ricochet Chollima, TEMP.Reaper, APT-C-28) launched a targeted spear-phishing campaign against researchers, policy specialists, and academics working on North Korea-related and Wonsan-Kalma tourism-zone topics. The lure abused the legitimacy of a real academic conference (the 'Why Wonsan-Kalma Tourism Now?' forum, held in Seoul on June 12, 2026) by referencing genuine event materials in the phishing email, which directed victims to a Dropbox-hosted link.

The Dropbox link delivered an ISO disk image (a technique APT37 favors because ISO mounting bypasses Mark-of-the-Web browser/download warnings). Inside the ISO was a single file using a deceptive multi-extension filename pattern ('.pdf.pif.pdf.pif.pdf.pif') that exploited Windows Explorer's default behavior of hiding known file extensions, so the victim saw what appeared to be a PDF document while the actual file was a Windows PIF (Program Information File) executable.

When executed, the PIF functioned as a multistage loader built on an 'EMBED_PAYLOAD_v2' structure: a container format bundling (1) a benign decoy PDF displayed to the victim to preserve the illusion of a legitimate document, and (2) a shellcode blob (observed on disk as 'yanfirst64.bin'). The loader extracted and displayed the decoy PDF while separately restoring the shellcode into memory. The shellcode used a call-pop routine to dynamically resolve its own memory location (a common position-independent-code technique to defeat static base-address assumptions), then decrypted its embedded payload using a single-byte XOR key of 0x29 -- the same XOR key Genians has previously documented in RokRAT's JPEG-steganography loader chain, indicating shared tooling/codebase across APT37 campaigns.

Once decrypted, the shellcode enumerated running processes via CreateToolhelp32Snapshot, located explorer.exe, opened a handle to it with OpenProcess, allocated remote memory with VirtualAllocEx, wrote the RokRAT payload into that memory with WriteProcessMemory, and executed it via RtlCreateUserThread -- a classic remote process-injection chain that lets the final backdoor run under the cover of a trusted, always-running system process (explorer.exe) rather than the loader's own process, defeating simple process-tree-based detections.

The injected x64 RokRAT variant performed environment/host fingerprinting (OS version, hostname, username, executable metadata, SMBIOS identifiers) before establishing command and control. Consistent with RokRAT's long-standing design, the malware abused legitimate cloud storage/API services -- Dropbox (initial ISO hosting), pCloud, and Yandex Cloud -- as command channels and exfiltration destinations, blending malicious traffic with normal cloud-service usage to evade network-based detection. Researchers identified a hardcoded multipart form-data boundary string ('--wwjaughalvncjwiajs--') and a spoofed User-Agent of 'Googlebot/2.1' used in the malware's HTTP requests to cloud APIs, likely to blend into web-crawler traffic logs or bypass simplistic User-Agent filtering.

Core RokRAT capabilities observed/documented include: screenshot capture, file collection and drive/directory enumeration, process listing, arbitrary command execution issued by the operator, and on-command trace removal from temp directories and the Startup folder to reduce forensic footprint.

Genians Security Center's attribution to APT37 rests on several independent overlaps rather than a single indicator: (1) the same Yandex OAuth tokens and Yandex accounts previously observed in APT37's 'Operation Artemis' and other RokRAT campaigns were reused in this operation's C2 configuration; (2) the cloud-service C2 design (Dropbox/pCloud/Yandex triad) matches APT37's established RokRAT infrastructure pattern going back to at least 2016; (3) the malware's command-processing logic, string-decryption routine, and shellcode XOR-key scheme are consistent with prior RokRAT samples attributed to the group. Genians assesses this with high, though not absolute, confidence, noting formal attribution would require further corroboration.

The targeting -- researchers, policy specialists, and academics working on North Korea/Wonsan-Kalma-related subject matter -- is squarely consistent with APT37's espionage mandate on behalf of North Korean state interests, which has historically prioritized intelligence collection against South Korean government, defense, academic, and NGO targets, as well as international North Korea watchers.

No CVE applies: this is a social-engineering-driven, non-exploit intrusion chain (spear-phishing -> ISO/PIF masquerade -> in-memory shellcode -> process injection -> cloud-C2 RAT), and the threat is scored on TTP novelty (the EMBED_PAYLOAD_v2 dual-content container and multi-extension PIF masquerade) and nation-state attribution rather than a vulnerability metric.