Top Tweets for #RokRat
"Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2" published by @WithGENIANS. #APT37, #RokRAT, #T1566002, #T1055, #CapsuleVault https://t.co/7skphwNupU
"Operation Capsule Vault: EMBED_PAYLOAD_v2 기반 RokRAT 공격 체인 분석" published by @WithGENIANS. #APT37, #RokRAT, #T1566002, #T1055, #CapsuleVault https://t.co/SUDjVPxLbW
#NorthKorea #APT37 #RokRAT
Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2
https://t.co/vwPH3x694y
e5c9bb3938f2a24e755ee39073fc3aca
5.180.208[.]57
5.180.208[.]60
89.147.101[.]197
89.187.161[.]220
160.238.37[.]95
160.238.37[.]100
![cyberwar_15's tweet photo. #NorthKorea #APT37 #RokRAT
Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2
https://t.co/vwPH3x694y
e5c9bb3938f2a24e755ee39073fc3aca
5.180.208[.]57
5.180.208[.]60
89.147.101[.]197
89.187.161[.]220
160.238.37[.]95
160.238.37[.]100 https://t.co/kuw06g8Pl7](https://pbs.twimg.com/media/HNEBqM3aYAAJrgW.jpg)
APT37 pivots to Facebook social engineering, using Wondershare PDFelement "code caves" to deploy RokRAT. Learn how they bypass EDR with memory-only payloads.
#APT37 #RokRAT #CyberSecurity #SocialEngineering #ThreatIntel #InfoSec #NorthKorea
https://t.co/aL7wp2m4mD
#TTP
👻[T1598] Collect + convince (FB recon)
📩[T1566.004] Phishing (TG delivery)
👥[T1036.005] Fake PDF and wondershare
💉[T1055.002] Inject SC into dism.exe
📥[T1105] Download next stage
🖼️[T1027.003] Stego (jpg) #SC
🧩[T1140] Decrypt PE (#RokRat)
👥[T1620] Load #SC + #RokRat
🕷️[T1082] System info collection
📡[T1102.002] C&C using Zoho
📤[T1041] Exfiltration
![RexorVc0's tweet photo. #TTP
👻[T1598] Collect + convince (FB recon)
📩[T1566.004] Phishing (TG delivery)
👥[T1036.005] Fake PDF and wondershare
💉[T1055.002] Inject SC into dism.exe
📥[T1105] Download next stage
🖼️[T1027.003] Stego (jpg) #SC
🧩[T1140] Decrypt PE (#RokRat)
👥[T1620] Load #SC + #RokRat
🕷️[T1082] System info collection
📡[T1102.002] C&C using Zoho
📤[T1041] Exfiltration](https://pbs.twimg.com/media/HF2B5Y_W8AA1pni.jpg)
![RexorVc0's tweet photo. #TTP
👻[T1598] Collect + convince (FB recon)
📩[T1566.004] Phishing (TG delivery)
👥[T1036.005] Fake PDF and wondershare
💉[T1055.002] Inject SC into dism.exe
📥[T1105] Download next stage
🖼️[T1027.003] Stego (jpg) #SC
🧩[T1140] Decrypt PE (#RokRat)
👥[T1620] Load #SC + #RokRat
🕷️[T1082] System info collection
📡[T1102.002] C&C using Zoho
📤[T1041] Exfiltration](https://pbs.twimg.com/media/HF2BwQhaEAAqKYE.jpg)
![RexorVc0's tweet photo. #TTP
👻[T1598] Collect + convince (FB recon)
📩[T1566.004] Phishing (TG delivery)
👥[T1036.005] Fake PDF and wondershare
💉[T1055.002] Inject SC into dism.exe
📥[T1105] Download next stage
🖼️[T1027.003] Stego (jpg) #SC
🧩[T1140] Decrypt PE (#RokRat)
👥[T1620] Load #SC + #RokRat
🕷️[T1082] System info collection
📡[T1102.002] C&C using Zoho
📤[T1041] Exfiltration](https://pbs.twimg.com/media/HF2BsyHXAAADjy7.png)
![RexorVc0's tweet photo. #TTP
👻[T1598] Collect + convince (FB recon)
📩[T1566.004] Phishing (TG delivery)
👥[T1036.005] Fake PDF and wondershare
💉[T1055.002] Inject SC into dism.exe
📥[T1105] Download next stage
🖼️[T1027.003] Stego (jpg) #SC
🧩[T1140] Decrypt PE (#RokRat)
👥[T1620] Load #SC + #RokRat
🕷️[T1082] System info collection
📡[T1102.002] C&C using Zoho
📤[T1041] Exfiltration](https://pbs.twimg.com/media/HF2Bpt1XwAAZQek.jpg)
#APT #APT37 #RicochetChollima #ScarCruft #threat #malware #RAT #RokRAT
📍🇰🇵
💥🇰🇷
⛓️Pretexting + #Phishing > Facebook | Telegram > ZIP > Fake #PDF + Fake Wondershare (exe) > Wondershare execution > #SC > Download next stage (jpg) > #SC + #RAT Load in mem > Gather info > #C2
🔗 Genians analysis: https://t.co/L22wir6stj
"APT37’s Pretexting-Based Targeted Intrusion: Analysis of Facebook Reconnaissance and Software Tampering Attacks" published by @WithGENIANS. #APT37, #RokRat, #DPRK, #CTI https://t.co/Ln0WBOSi0l
"APT37의 프리텍스팅 기반 표적 침투: 페이스북 정찰과 소프트웨어 변조 공격 분석" published by @WithGENIANS. #APT37, #RokRat, #DPRK, #CTI https://t.co/SnC6tkBxv3
"Scarcruft’s ROKRAT Malware: Recent Changes" published by @S2W_Official. #RokRAT, #ScarCruft, #DPRK, #CTI https://t.co/PWIZpSr5St
#ScarCruft is evolving its approach to distributing ROKRAT malware.
Our latest report examines recent changes in how #ROKRAT is distributed and the techniques observed in recent cases.
👉 Learn more: https://t.co/MJMx8hTcUd
"스카크러프트 악성코드(Scarcruft ROKRAT): 새로운 유포 방식의 출현" published by @S2W_Official. #RokRAT, #ScarCruft, #DPRK, #CTI https://t.co/SZDXMsJ9ZK
this might be the funniest thing i've seen this week thanks north koreans #rokrat
APT37 : New spear-phishing lure spotted using “2025 북한인권 청년 아카데미 강의 주제.pdf.lnk” as a decoy. Theme focuses on North Korean human-rights NGOs consistent with targeted ops against SK human-rights groups, researchers, & policy.
#CyberThreats #APT37 #ROKRAT #Korea #CTI
![suyog41's tweet photo. ROKRAT
2025 북한인권 청년 아카데미 강의 주제.pdf.lnk
2025 North Korean Human Rights Youth Academy Lecture Topics.pdf.lnk
ad6273981cb53917cb8bda8e2f2e31a8
aa[.]zip
a6392cfc3a11b972a7060c221d51d1fc
C2
jlrandsons[.]co[.]uk
#ROKRAT #APT37 #APT #IOC https://t.co/dTsTxUHkhx](https://pbs.twimg.com/media/G7Jj5KWakAA60Qi.png)
8[.]210[.]98[.]219
8[.]223[.]59[.]119
8[.]223[.]56[.]120
AS45102 Alibaba US Technology Co., Ltd 🇭🇰
183[.]60[.]146[.]66
AS4134 Chinanet 🇨🇳
119[.]29[.]29[.]29
AS132203 Tencent Building, Kejizhongyi Avenue 🇨🇳
#PureLogsStealer #RokRAT
![skocherhan's tweet photo. 8[.]210[.]98[.]219
8[.]223[.]59[.]119
8[.]223[.]56[.]120
AS45102 Alibaba US Technology Co., Ltd 🇭🇰
183[.]60[.]146[.]66
AS4134 Chinanet 🇨🇳
119[.]29[.]29[.]29
AS132203 Tencent Building, Kejizhongyi Avenue 🇨🇳
#PureLogsStealer #RokRAT https://t.co/Dd3tNXRT2P](https://pbs.twimg.com/media/G6J5xDMWcAAHHDW.jpg)
![skocherhan's tweet photo. 8[.]210[.]98[.]219
8[.]223[.]59[.]119
8[.]223[.]56[.]120
AS45102 Alibaba US Technology Co., Ltd 🇭🇰
183[.]60[.]146[.]66
AS4134 Chinanet 🇨🇳
119[.]29[.]29[.]29
AS132203 Tencent Building, Kejizhongyi Avenue 🇨🇳
#PureLogsStealer #RokRAT https://t.co/Dd3tNXRT2P](https://pbs.twimg.com/media/G6J5UucWYAAJZXo.jpg)
![skocherhan's tweet photo. 8[.]210[.]98[.]219
8[.]223[.]59[.]119
8[.]223[.]56[.]120
AS45102 Alibaba US Technology Co., Ltd 🇭🇰
183[.]60[.]146[.]66
AS4134 Chinanet 🇨🇳
119[.]29[.]29[.]29
AS132203 Tencent Building, Kejizhongyi Avenue 🇨🇳
#PureLogsStealer #RokRAT https://t.co/Dd3tNXRT2P](https://pbs.twimg.com/media/G6J5KxUWYAARzHo.jpg)
![skocherhan's tweet photo. 8[.]210[.]98[.]219
8[.]223[.]59[.]119
8[.]223[.]56[.]120
AS45102 Alibaba US Technology Co., Ltd 🇭🇰
183[.]60[.]146[.]66
AS4134 Chinanet 🇨🇳
119[.]29[.]29[.]29
AS132203 Tencent Building, Kejizhongyi Avenue 🇨🇳
#PureLogsStealer #RokRAT https://t.co/Dd3tNXRT2P](https://pbs.twimg.com/media/G6J5G2VXYAAHnjC.jpg)
![suyog41's tweet photo. ROKRAT
ee648192370dacdf2a1e9fe7deac95d1 zip
1. KB국민은행 거래내역 제출 안내서.hwp.lnk
KB Kookmin Bank Transaction History Submission Guide.hwp.lnk
f5842320e04c2c97d1f69cebfd47df3d
C2
igamingroundtable[.]com
#ROKRAT #APT37 #APT #IOC https://t.co/4JM1dHK4b7](https://pbs.twimg.com/media/G5Iv9r-aQAAM_nP.png)
Last Seen Hashtags on Sotwe
minichat() +filter:native_video
Seen from United States
aunty
Seen from France
papmantan
Seen from Indonesia
snapchat()* filter:videos
Seen from United States
robloxfart
Seen from Vietnam
rosex
Seen from Russia
Cuckcift34
Seen from Turkey
tudung
Seen from Turkey
arianfzn
Seen from Portugal
MGAI()**************************
Seen from France
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers