SAS2019 Presentation

This presentation analyzes ScarCruft (APT37), a Korean-speaking, state-linked APT that uses spearphishing, weaponized HWP/Word files, public and zero-day exploits (e.g., CVE-2016-4171, CVE-2017-11182, CVE-2018-8120) and web waterhole attacks to deliver custom tooling including a cloud-based backdoor (ROKRAT) that exfiltrates data via cloud services (Box, Dropbox, Pcloud, Yandex); it includes TTPs, C2 details, sample IOCs (IPs/domains, payload patterns), victimology across the Korean-peninsula interest sphere, and operational comparisons with other groups like DarkHotel.