North Korea's ScarCruft Deploys RokRAT Malware via LNK File Infection Chains

The North Korean threat actor known as ScarCruft began experimenting with oversized LNK files as a delivery route for RokRAT malware as early as July 2022, the same month Microsoft began blocking macros across Office documents by default.
"RokRAT has not changed significantly over the years, but its deployment methods have evolved, now utilizing archives containing LNK files that initiate

actor blocking default delivery deployment documents file files infection july july 2022 korea lnk lnk file macros malware microsoft north north korea north korean office rokrat rokrat malware scarcruft threat threat actor