Chain Reaction: ROKRAT’s Missing Link

Key findings

• Check Point Research (CPR) continues to track the evolution of ROKRAT and its delivery methods.


• ROKRAT has not changed significantly over the years, but its deployment methods have evolved, now utilizing archives containing LNK files that initiate multi-stage infection chains. This is another representation of a major trend in the threat landscape, where APTs and cybercriminals alike attempt to overcome the blocking of macros from untrusted sources. The first sample we will discuss below was first discovered in …

chain reaction check check point delivery deployment files findings infection key link lnk major malware analysis missing point representation research rokrat stage threat threat landscape trend