Cisco's Talos Intelligence Group Blog: Korea In The Crosshairs

This Talos report analyzes a year of activity by a persistent threat actor (Group 123) that targeted South Korea and other organizations through tailored spearphishing using HWP and Office documents, exploited known CVEs to deliver ROKRAT (including a fileless variant), Freenki, PoohMilk and a disk-wiper module, documents shared code/PDB artifacts across campaigns, catalogs detailed TTPs (process injection, anti-sandbox, cloud-based C2), and provides extensive IoCs (hashes, URLs, domains) for detection and response.