A targeted phishing campaign is using genuine academic event details to trick researchers into opening malware. <\/p>\n
The operation delivers a RokRAT variant through a fake document package that appears connected to a real seminar.<\/p>\n
The attackers used information from an actual academic event to make the email look routine and trustworthy. <\/p>\n
Recipients were led to a cloud-hosted ISO file that looked like a normal conference-material download, increasing the chance that it would be opened.<\/a><\/p>\n Genians\u00a0said in a report<\/a> shared with Cyber Security News (CSN) that it identified the activity as\u00a0Operation Capsule Vault. <\/p>\n The name reflects the way attackers hide both a legitimate-looking document and malicious components inside a single executable container.<\/a><\/p>\n The campaign shows how threat actors can turn public event information into a convincing lure. <\/p>\n Rather than relying on obviously suspicious messages, the operators used familiar professional context, making the attack harder for busy researchers and staff to spot before opening the file.<\/a><\/p>\n The phishing messages claimed to distribute materials<\/a> for the Honsan Kalma Tourism Forum, an event held in Seoul on June 9. <\/p>\n Attackers impersonated a separate organization and framed the email as a standard business notice containing conference-related materials.<\/p>\n Instead of attaching a normal document, the email directed recipients to a Dropbox-hosted ISO image. <\/p>\n The ISO used a filename resembling a seminar booklet and contained a program disguised as a PDF, exploiting the fact that Windows may hide known file extensions from users.<\/a><\/p>\n Once launched, the deceptive file displays the expected academic document while malicious activity continues in the background. <\/p>\n This dual approach helps reduce suspicion because the victim sees material that appears relevant to the message they received.<\/a><\/p>\n The executable works as a multistage loader<\/a>, extracting additional embedded content before starting the next phase. <\/p>\n Analysts found that the lure document had content tied to the real event, while its creation details showed a time mismatch that indicated the file was not an authentic event handout.<\/a><\/p>\n The loader restores shellcode in memory and injects the RokRAT payload into\u00a0 Running inside a legitimate process can make malicious behavior less visible and complicate detection based only on newly created programs.<\/a><\/p>\n After execution, the malware gathers system details and prepares cloud-based communications. <\/p>\n The report found support for Dropbox, pCloud, and Yandex services, with separate channels for receiving commands and uploading collected information.<\/p>\n RokRAT can take screenshots, collect files, enumerate drives, gather process information, and run commands issued by its operators. <\/p>\n It can also remove selected traces, including files created in temporary locations and the Startup folder, after receiving an instruction to clean up.<\/a><\/p>\n The researchers linked the campaign to the broader RokRAT family through its cloud-service design, command handling, and code similarities with earlier activity. <\/p>\n They assessed the operation as likely connected to the APT37 group, while noting that attribution should consider infrastructure, victim patterns, tactics, and other evidence together.<\/a><\/p>\n Organizations should verify unexpected event-material emails through official channels before opening links or files. <\/p>\n Security teams should also monitor unusual ISO downloads<\/a>, document-like executables, abnormal process injection, and cloud-service connections that follow suspicious email activity.<\/a><\/p>\n![\"Attack](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhOUgJ_S0r0ZnAyPMoa9IcTEfPNeEYm9HA7v-7PkBrPfCLkO3PnalwgKyIB7bk4vXPiQZhMKnNYMJou_Y5Ze3JLillxzHjKZPuPvwECw1XZ0oj_7Oe-YFcJyPYmVJ5Jmaamh0dCFbO4wxMr0wYhsJ3zowauCRKdCnizRBdDPzW-Z6Pn8zF8ep2fVu0Dx6o\/s1600\/Attack%2520Flow%2520%28Source%2520-%2520Genians%29.webp?ssl=1\")
Hackers Weaponize Real Academic Event Materials<\/strong><\/h2>\n
![\"Spear-Phishing](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj7u8uPYlW7zVdDqQ8QwNt8UE93-hVy61XdYZ5Iic4C7jeoBIvQd9VWKIV9KEAGhulgO47v2UkaMn58HL_dazjy9YJCpJ00Dc-IaUbOzBc_YWhyVOz-tLWrXSp_SvZAa-WEDy-cBiTFgKXx-Ov_r1dzlz3_QRDt-k9SC_vh7xZdvmuZrf_RDSb_H7k8JBo\/s1600\/Spear-Phishing%2520Email%2520Screen%2520%28Source%2520-%2520Genians%29.webp?ssl=1\")
RokRAT Hides Behind Legitimate Processes<\/strong><\/h2>\n
explorer.exe<\/code>, a normal Windows process. <\/p>\n![\"Payload](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgrqGP0gIBcfZ0EI1cYmvrfbhDbTfzKTcrxNQpSdM27o93lVEXmY0bIIj7enHTnzKJY-z6jNbOrRk9ODuBBtmqLIHbhwevSgClFqU1yRgtPhj_jnro6FpCIEIIkWdtOAcNn5dkxOSqjxOB6UHGcY_KcPtDqsU0YBNvEAZgjC52XzASdtAacVxrro1v-NjA\/s1600\/Payload%2520Table%2520%28Source%2520-%2520Genians%29.webp?ssl=1\")