Log in Request a demo

Malware profile

ROKRAT

ROKRAT is a cloud-based remote access tool for Windows.

In short

ROKRAT is a cloud-based remote access tool for Windows. MITRE ATT&CK lists APT37, which it describes as a North Korean state-sponsored espionage group, as the user and says it was used against victims in South Korea in several campaigns from 2016 through 2021. It can log keystrokes, take screenshots, record audio and steal browser credentials, and it uses cloud and social networking services to reach its operators.

Last updated 10 October 2026

Profile MapMalware
  1. Names1names in public reportsROKRAT
  2. Techniques19ATT&CK techniques listedInitial Access · Execution · Stealth
  3. Linked Groups1groups that use itAPT37

In one minute

What it is
A cloud-based remote access tool (RAT) for Windows, per MITRE ATT&CK.
What it does
Collects host data and files, logs keystrokes, takes screenshots, records audio and steals browser credentials, then can send data out to cloud storage.
Who uses it
MITRE lists APT37, which it describes as a North Korean state-sponsored espionage group, as the user. MITRE says the group used ROKRAT to target victims in South Korea.
How it gets in
MITRE says it was delivered by spear phishing emails with a malicious Hangul Office or Microsoft Word document, and relied on the user opening the attachment.
What to do first
Block or scan unneeded attachment types in email, and watch for company devices that talk to cloud storage and social sites the business does not use.

What it does

MITRE says ROKRAT is built to be hard to study. It can check for sandbox files, DLLs and debugging tools, and it needs a specific victim hostname to run and to decrypt its key strings.

It hides its command traffic in services people use every day. MITRE lists Twitter, Yandex, Dropbox and Mediafire as examples, and says it can send collected data to cloud storage such as pCloud.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
ROKRATName of MITRE ATT&CK software S0240; MITRE lists no other alias[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    It has been delivered in spear phishing emails that carry a malicious Hangul Office or Microsoft Word document.[1]

Execution

  • User Execution: Malicious File T1204.002

    It has relied on users opening a malicious attachment.[1]

  • Command and Scripting Interpreter: Visual Basic T1059.005

    It has used Visual Basic for execution.[1]

  • Native API T1106

    It can use a range of API calls to run shellcode.[1]

Stealth

  • Process Injection T1055

    It can write shellcode into the memory of Notepad.exe and start it with a remote thread.[1]

  • Execution Guardrails: Environmental Keying T1480.001

    It relies on a specific victim hostname to run and to decrypt important strings.[1]

  • Virtualization/Sandbox Evasion: System Checks T1497.001

    It can check for VMware related files and for DLLs that belong to sandboxes.[1]

  • Debugger Evasion T1622

    It can check for debugging tools.[1]

Collection

  • Input Capture: Keylogging T1056.001

    It can capture keystrokes.[1]

  • Screen Capture T1113

    It can capture screenshots of the infected system.[1]

  • Audio Capture T1123

    It has an audio capture and eavesdropping module.[1]

  • Clipboard Data T1115

    It can extract clipboard data from a compromised host.[1]

  • Data from Local System T1005

    It can collect host data and specific file types.[1]

Credential Access

  • Credentials from Password Stores: Credentials from Web Browsers T1555.003

    It can steal credentials stored in web browsers.[1]

  • Credentials from Password Stores: Windows Credential Manager T1555.004

    It can steal credentials through the Windows Vault mechanism.[1]

Command and Control

  • Web Service: Bidirectional Communication T1102.002

    It has used legitimate social networking sites and cloud platforms, including Twitter, Yandex, Dropbox and Mediafire, for two way command traffic.[1]

  • Ingress Tool Transfer T1105

    It can fetch more malicious payloads from its command server.[1]

  • Application Layer Protocol: Web Protocols T1071.001

    It can use HTTP and HTTPS for command and control.[1]

Exfiltration

  • Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002

    It can send collected data to cloud storage services such as pCloud.[1]

How it spreads

MITRE says ROKRAT has been delivered through spear phishing emails that carry a malicious Hangul Office or Microsoft Word document, and that it relies on users opening the attachment. It adds that the malware has used Visual Basic for execution. No government advisory read for this page describes other routes.

Timeline

  1. 2016 to 2021

    ROKRAT used in several campaigns

    MITRE says APT37 used ROKRAT during several campaigns from 2016 through 2021.[1]

  2. 22 January 2024

    CERT-EU records APT37 activity disclosed by researchers

    CERT-EU Cyber Security Brief 24-02 records that on 22 January researchers disclosed activity by ScarCruft (APT37) aimed at South Korean academics and a North Korea focused news organization. The brief does not name ROKRAT.[7]

Detection and defense

  1. Block unknown attachments

    MITRE advises blocking unknown or unused attachment types by default and using network intrusion prevention or email scanning that removes malicious attachments.[3]

    Counters: T1566.001

  2. Limit what opened files can run

    MITRE advises Windows 10 attack surface reduction rules against executables started by Office applications, scripting interpreters or email clients, and application control against files that pose as something else.[5]

    Counters: T1204.002

  3. Restrict Visual Basic and macros

    MITRE advises attack surface reduction rules for Visual Basic scripts, turning off unneeded Visual Basic components, and keeping Office from running macros in files from the internet by default.[6]

    Counters: T1059.005

  4. Control which outside services systems may use

    MITRE advises web proxies that enforce a policy on external services, plus network signatures that identify traffic of known malware.[4]

    Counters: T1102.002

  5. Train staff on spear phishing

    MITRE advises user training so people can recognize phishing and spear phishing and report suspicious events.[5]

    Counters: T1204.002 T1566.001

  6. Know what is not published

    No government advisory with ROKRAT detection signatures or indicators was found. Use MITRE S0240 as the official reference.[1]

Questions

What is ROKRAT?

MITRE ATT&CK describes ROKRAT as a cloud-based remote access tool (RAT) for Windows that APT37 used to target victims in South Korea.

Who uses ROKRAT?

MITRE lists APT37 and describes it as a North Korean state-sponsored cyber espionage group active since at least 2012. MITRE says the group used ROKRAT in several campaigns from 2016 through 2021.

How does ROKRAT get onto a computer?

MITRE says it has been delivered by spear phishing emails that contain a malicious Hangul Office or Microsoft Word document, and that it relies on the user opening the attachment.

How does ROKRAT talk to its operators?

MITRE says it has used legitimate social networking sites and cloud platforms, including Twitter, Yandex, Dropbox and Mediafire, for command and control, and can send data to cloud storage such as pCloud.

What does ROKRAT check before it runs?

MITRE says it can check for VMware related files, sandbox DLLs and debugging tools, and that it relies on a specific victim hostname to run and decrypt important strings.

In our research

  1. RokRAT Technical Analysis July 2025
  2. [Research Summary]: RokRat June 2024
  3. APT37: North Korea’s Active Cyberespionage Group November 2025
  4. APT37 Threat group

Sources

  1. ROKRAT, Software S0240 MITRE ATT&CKSupports: Description, platform, techniques with use sentences, APT37 as the listed group
  2. APT37, Group G0067 MITRE ATT&CKSupports: APT37 described as North Korean state-sponsored, active since at least 2012, lists ROKRAT
  3. Phishing: Spearphishing Attachment, T1566.001 MITRE ATT&CKSupports: Mitigations for malicious email attachments
  4. Web Service: Bidirectional Communication, T1102.002 MITRE ATT&CKSupports: Mitigations for command traffic through web services
  5. User Execution: Malicious File, T1204.002 MITRE ATT&CKSupports: Mitigations M1040, M1038 and M1017
  6. Command and Scripting Interpreter: Visual Basic, T1059.005 MITRE ATT&CKSupports: Mitigations for Visual Basic and macros
  7. CERT-EU Cyber Security Brief 24-02, January 2024 CERT-EUSupports: ScarCruft (APT37) activity disclosed on 22 January 2024; does not name ROKRAT

Browse the threat library

Keep exploring

Knowledge Hub

Article

RokRAT Technical Analysis

Learn Technical Method of Operation DetailsYou will find the technical details of the RokRAT and details how state-sponsored threat actor APT37 use it.The report…

Read more

Article

[Research Summary]: RokRat

RokRAT technical analysis: how a .lnk file disguised as a PDF runs PowerShell and drops the RokRAT trojan, with MITRE ATT&CK mapping and defences.

Read more

Glossary term

Remote access trojan (RAT)

A remote access trojan, or RAT, is malware that lets an attacker control a computer from a distance.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more