APT37__2021__blog.malwarebytes.com-Retrohunting_APT37_North_Korean_APT_used_VBA_self_decode_technique_to_inject_RokRat.pdf

Malwarebytes Threat Intelligence details a spearphishing campaign attributed to North Korea's APT37 that weaponized a Microsoft Word document using a VBA self-decoding macro to unpack and execute a payload in memory, injecting a variant of the RokRat remote access Trojan into Notepad; the report provides step‑by‑step macro and shellcode analysis, anti‑analysis checks, RokRat capabilities (credential theft, screenshots, cloud-based exfiltration), and IOCs including hashes and the download URL.