APT37__2019__ScarCruft_continues_to_evolve_introduces_Bluetooth_harvester_Securelist.pdf

ScarCruft (ScarCraft) is a Korean-speaking, likely state-sponsored APT that conducts multi-stage infections—using spear-phishing/SWC, UAC bypass (CVE-2018-8120/UACME), steganographic downloaders—to deploy a cloud-based ROKRAT backdoor and an uncommon Bluetooth device harvester; the report details victimology (diplomatic and investment targets), overlaps with DarkHotel, and provides numerous IOCs (file hashes, URLs, domains and IPs).