H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

ROKRAT

[ROKRAT](https://attack.mitre.org/software/S0240) is a cloud-based remote access tool (RAT) used by [APT37](https://attack.mitre.org/groups/G0067) to target victims in South Korea. [APT37](https://attack.mitre.org/groups/G0067) has used ROKRAT during several campaigns from 2016 through 2021.(Citation: Talos ROKRAT)(Citation: Talos Group123)(Citation: Volexity InkySquid RokRAT August 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[ROKRAT](https://attack.mitre.org/software/S0240) is a cloud-based remote access tool (RAT) used by [APT37](https://attack.mitre.org/groups/G0067) to target victims in South Korea. [APT37](https://attack.mitre.org/groups/G0067) has used ROKRAT during several campaigns from 2016 through 2021.(Citation: Talos ROKRAT)(Citation: Talos Group123)(Citation: Volexity InkySquid RokRAT August 2021)

Labels

malware
31 recorded

Relationships

uses
from APT37
Group
uses
to Application Window Discovery
Technique
uses
to Audio Capture
Technique
uses
to Bidirectional Communication
Technique
uses
to Clipboard Data
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Data from Local System
Technique
uses
to Debugger Evasion
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Environmental Keying
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to Exfiltration to Cloud Storage
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Keylogging
Technique
uses
to Malicious File
Technique
uses
to Modify Registry
Technique
uses
to Native API
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Process Discovery
Technique
uses
to Process Injection
Technique
uses
to Query Registry
Technique
uses
to Screen Capture
Technique
uses
to Spearphishing Attachment
Technique
uses
to System Checks
Technique
uses
to System Information Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Visual Basic
Technique
uses
to Web Protocols
Technique
uses
to Windows Credential Manager
Technique
6 external

References

mitre-attack
S0240
open
ROKRAT
—
Talos ROKRAT
https://blog.talosintelligence.com/2017/04/introducing-rokrat.html
open
Talos Group123
https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html
open
Volexity InkySquid RokRAT August 2021
https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/
open
Talos ROKRAT 2
https://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance