{"id":1715,"date":"2025-02-03T10:03:36","date_gmt":"2025-02-03T10:03:36","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/03\/apt37-hackers-abusing-group-chats-to-attack-via-malicious-lnk-file\/"},"modified":"2025-02-03T10:03:36","modified_gmt":"2025-02-03T10:03:36","slug":"apt37-hackers-abusing-group-chats-to-attack-via-malicious-lnk-file","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/03\/apt37-hackers-abusing-group-chats-to-attack-via-malicious-lnk-file\/","title":{"rendered":"APT37 Hackers Abusing Group Chats To Attack Via Malicious LNK File"},"content":{"rendered":"

APT37 Hackers Abusing Group Chats To Attack Via Malicious LNK File
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The North Korean state-sponsored hacking group APT37 (aka ScarCruft, Reaper), has been identified leveraging group chat platforms to distribute malicious LNK files.<\/p>\n

This latest tactic highlights the group\u2019s evolving methods to infiltrate systems and exfiltrate sensitive data.<\/p>\n

APT37\u2019s recent campaign involves sending malicious LNK files through group chats on popular messaging platforms.<\/p>\n

These files are often embedded in ZIP archives and disguised with familiar icons and filenames to deceive targets.<\/p>\n

For instance, attackers used filenames such as \u201cChanges in Chinese Government\u2019s North Korea Policy.zip\u201d to lure victims into opening the file.<\/p>\n

Analysts at Genians identified<\/a> that once executed, the LNK file triggers a PowerShell command that initiates a multi-stage infection chain.<\/p>\n

\n
\"\"
Attack Timeline Flowchart (Source \u2013 Genians)<\/figcaption><\/figure>\n<\/div>\n

The command decodes and executes embedded scripts, often leading to the deployment of the RokRAT malware.<\/p>\n

RokRAT is a powerful remote access trojan<\/a> (RAT) capable of data exfiltration, screen capturing, and remote command execution.<\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n

Attack Analysis<\/strong><\/h2>\n

The malicious LNK files contain embedded PowerShell commands that execute hidden scripts.<\/p>\n

This script reads a malicious payload from a temporary file (bus.dat<\/code>), decodes it, and executes it in memory.<\/p>\n

Such fileless execution techniques evade traditional antivirus detection<\/a>.<\/p>\n

\n
\"\"
Attack vector (Source \u2013 Genians)<\/figcaption><\/figure>\n<\/div>\n

APT37 employs social engineering tactics by impersonating trusted individuals or organizations. For example, attackers have used themes like geopolitical reports or lecture materials as bait.<\/p>\n

These files often appear legitimate but contain embedded OLE objects or scripts that activate upon interaction.<\/p>\n

The primary payload in these attacks is often RokRAT or similar malware variants. Key features include:-<\/p>\n