Ankura CTIX FLASH Update - October 18, 2024

Threat Actor "ScarCruft" (AKA "APT37" or "RedEyes") has allegedly exploited an Internet Explorer zero-day flaw to host zero-click malware on toast advertisements. ScarCruft is a hacking group tied to North Korea and is known for targeting victims in South Korea and Europe with phishing, watering hole, and zero-day attacks. In a large-scale attack in May 2024, ScarCruft exploited a zero-day vulnerability in Internet Explorer to install the RokRAT malware on victim systems. RokRAT is designed to exfiltrate data to a Yandex cloud, log keystrokes, monitor for clipboard changes, and capture screenshots every three (3) minutes. ScarCruft has been known to use RokRAT in their attacks over the past few years. Cybersecurity researchers notified Microsoft of the campaign and flaw in August 2024, and although Internet Explorer is out of support, Microsoft released a security update to address the vulnerability tracked as CVE-2024-38178. ScarCruft carried out their campaign by