APT37__2021__volexity.com-North_Korean_BLUELIGHT_Special_InkySquid_Deploys_RokRAT.pdf

**North Korean BLUELIGHT Special: InkySquid Deploys RokRAT** — Volexity analyzed a targeted intrusion attributed to North Korea’s APT37 (InkySquid) where attacker(s) used a compromised news portal and patched browser exploits to deliver BLUELIGHT and, shortly after, a customized RokRAT backdoor. The threat used full-language runtimes (Python 2.7 and Ruby) as loaders with encoded blobs on disk and scheduled tasks to execute memory-resident payloads; both malware families used legitimate cloud services (Google Web App, pCloud, Yandex, Dropbox, Box) for C2 and employed host-specific decryption to enforce victim-targeting. The report includes file hashes, C2 indicators, observed TTPs, and mitigation suggestions such as blocking specific cloud domains, monitoring suspicious scheduled tasks, and using provided YARA rules.