# Operation Capsule Vault: APT37 Weaponizes Real Academic Event Materials to Deliver RokRAT via ISO/Process Injection

> APT37 (ScarCruft) ran a spear-phishing campaign, 'Operation Capsule Vault,' impersonating the real 'Why Wonsan-Kalma Tourism Now?' academic forum held in Seoul to lure researchers, policy specialists, and North Korea-focused academics into opening a Dropbox-hosted ISO disguised as seminar materials. The ISO's EMBED_PAYLOAD_v2 executable used a deceptive multi-extension filename (.pdf.pif.pdf.pif.pdf.pif) to display a decoy PDF while decrypting XOR-obfuscated shellcode in memory and injecting the RokRAT remote access trojan into explorer.exe. Genians Security Center attributed the campaign to APT37 with high confidence based on reused Yandex OAuth tokens/accounts, cloud C2 design overlap with prior operations (including Operation Artemis), and consistent RokRAT code structure.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1285
- **ID:** TL-2026-1285
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT37 (North Korea)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning June 22, 2026, APT37 (also tracked as ScarCruft, InkySquid, Reaper, Group123, Ricochet Chollima, TEMP.Reaper, APT-C-28) launched a targeted spear-phishing campaign against researchers, policy specialists, and academics working on North Korea-related and Wonsan-Kalma tourism-zone topics. The lure abused the legitimacy of a real academic conference (the 'Why Wonsan-Kalma Tourism Now?' forum, held in Seoul on June 12, 2026) by referencing genuine event materials in the phishing email, which directed victims to a Dropbox-hosted link.

The Dropbox link delivered an ISO disk image (a technique APT37 favors because ISO mounting bypasses Mark-of-the-Web browser/download warnings). Inside the ISO was a single file using a deceptive multi-extension filename pattern ('.pdf.pif.pdf.pif.pdf.pif') that exploited Windows Explorer's default behavior of hiding known file extensions, so the victim saw what appeared to be a PDF document while the actual file was a Windows PIF (Program Information File) executable.

When executed, the PIF functioned as a multistage loader built on an 'EMBED_PAYLOAD_v2' structure: a container format bundling (1) a benign decoy PDF displayed to the victim to preserve the illusion of a legitimate document, and (2) a shellcode blob (observed on disk as 'yanfirst64.bin'). The loader extracted and displayed the decoy PDF while separately restoring the shellcode into memory. The shellcode used a call-pop routine to dynamically resolve its own memory location (a common position-independent-code technique to defeat static base-address assumptions), then decrypted its embedded payload using a single-byte XOR key of 0x29 -- the same XOR key Genians has previously documented in RokRAT's JPEG-steganography loader chain, indicating shared tooling/codebase across APT37 campaigns.

Once decrypted, the shellcode enumerated running processes via CreateToolhelp32Snapshot, located explorer.exe, opened a handle to it with OpenProcess, allocated remote memory with VirtualAllocEx, wrote the RokRAT payload into that memory with WriteProcessMemory, and executed it via RtlCreateUserThread -- a classic remote process-injection chain that lets the final backdoor run under the cover of a trusted, always-running system process (explorer.exe) rather than the loader's own process, defeating simple process-tree-based detections.

The injected x64 RokRAT variant performed environment/host fingerprinting (OS version, hostname, username, executable metadata, SMBIOS identifiers) before establishing command and control. Consistent with RokRAT's long-standing design, the malware abused legitimate cloud storage/API services -- Dropbox (initial ISO hosting), pCloud, and Yandex Cloud -- as command channels and exfiltration destinations, blending malicious traffic with normal cloud-service usage to evade network-based detection. Researchers identified a hardcoded multipart form-data boundary string ('--wwjaughalvncjwiajs--') and a spoofed User-Agent of 'Googlebot/2.1' used in the malware's HTTP requests to cloud APIs, likely to blend into web-crawler traffic logs or bypass simplistic User-Agent filtering.

Core RokRAT capabilities observed/documented include: screenshot capture, file collection and drive/directory enumeration, process listing, arbitrary command execution issued by the operator, and on-command trace removal from temp directories and the Startup folder to reduce forensic footprint.

Genians Security Center's attribution to APT37 rests on several independent overlaps rather than a single indicator: (1) the same Yandex OAuth tokens and Yandex accounts previously observed in APT37's 'Operation Artemis' and other RokRAT campaigns were reused in this operation's C2 configuration; (2) the cloud-service C2 design (Dropbox/pCloud/Yandex triad) matches APT37's established RokRAT infrastructure pattern going back to at least 2016; (3) the malware's command-processing logic, string-decryption routine, and shellcode XOR-key scheme are consistent with prior RokRAT samples attributed to the group. Genians assesses this with high, though not absolute, confidence, noting formal attribution would require further corroboration.

The targeting -- researchers, policy specialists, and academics working on North Korea/Wonsan-Kalma-related subject matter -- is squarely consistent with APT37's espionage mandate on behalf of North Korean state interests, which has historically prioritized intelligence collection against South Korean government, defense, academic, and NGO targets, as well as international North Korea watchers.

No CVE applies: this is a social-engineering-driven, non-exploit intrusion chain (spear-phishing -> ISO/PIF masquerade -> in-memory shellcode -> process injection -> cloud-C2 RAT), and the threat is scored on TTP novelty (the EMBED_PAYLOAD_v2 dual-content container and multi-extension PIF masquerade) and nation-state attribution rather than a vulnerability metric.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1584.006 Web Services
- T1583 Acquire Infrastructure
- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1106 Native API
- T1059.005 Visual Basic
- T1547.015 Login Items
- T1055.001 Dynamic-link Library Injection
- T1068 Exploitation for Privilege Escalation
- T1055 Process Injection
- T1036.007 Double File Extension
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1497.001 System Checks
- T1622 Debugger Evasion
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1056.001 Keylogging
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1010 Application Window Discovery
- T1012 Query Registry
- T1113 Screen Capture
- T1005 Data from Local System
- T1115 Clipboard Data
- T1123 Audio Capture
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [Hackers Weaponize Real Academic Event Materials to Infect Researchers With RokRAT](https://cybersecuritynews.com/hackers-weaponize-real-academic-event-materials/)
- [Operation Capsule Vault Uses Malicious ISO Files and Process Injection to Deliver RokRAT](https://gbhackers.com/operation-capsule-vault-uses-iso-files/)
- [Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2](https://malware.news/t/operation-capsule-vault-rokrat-attack-chain-analysis-using-embed-payload-v2/123817)
- [실제 학술행사 자료집으로 위장…북한 해커조직 APT37, RokRAT 표적 공격 포착 (Genians via DailySecu)](https://www.dailysecu.com/news/articleView.html?idxno=207573)
- [RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies](https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_shellcode_steganographic)
- [Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story)](https://www.genians.co.kr/en/blog/threat_intelligence/toybox-story)
- [ROKRAT, Software S0240](https://attack.mitre.org/software/S0240/)
- [APT37, InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima, Group G0067](https://attack.mitre.org/groups/G0067/)
- [Dark Web Profile: ScarCruft / APT37](https://socradar.io/blog/threat-actor-profile-scarcruft-apt37/)
- [North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware](https://thehackernews.com/2026/04/north-koreas-apt37-uses-facebook-social.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1285