This threat involves a multi-stage spear-phishing attack leveraging a malicious ISO file with a PIF executable disguised as a PDF document. The EMBED_PAYLOAD_v2 structure allows embedding of both legitimate and malicious payloads that are extracted and executed in memory. The malware performs shellcode injection into the explorer.exe process to deploy a RokRAT variant. RokRAT communicates with cloud-based C2 infrastructure using services such as pCloud, Dropbox, and Yandex Cloud. The campaign uses advanced social engineering by exploiting real academic conference information and employs evasion techniques like process injection and cloud-hosted C2. Attribution analysis identifies APT37 as the actor behind this campaign. Indicators include multiple IP addresses and a file hash. There is no CVE or patch information available.

The campaign enables remote attackers to execute malicious code on targeted systems via spear-phishing and multi-stage payload execution. RokRAT malware deployed through this attack can establish persistent access and communicate with cloud-based C2 servers, potentially leading to data exfiltration or further compromise. The use of legitimate-looking documents and cloud services for C2 increases the difficulty of detection and mitigation.

No official patch or remediation is available for this threat. Defenders should be aware of the spear-phishing tactics involving academic conference-themed lures and malicious ISO attachments with disguised executables. Monitoring for the identified indicators of compromise (IPs and file hash) may assist detection. Given the use of cloud services for C2, network monitoring for unusual traffic to pCloud, Dropbox, and Yandex Cloud may be beneficial. Implementing user awareness training to recognize spear-phishing attempts is recommended. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources for updates.