This threat involves a multi-stage spear-phishing attack that targets research, policy, and academic individuals by sending emails that appear to be from a real academic conference. The attack delivers a malicious ISO file containing a PIF executable disguised as a PDF document. The loader uses the EMBED_PAYLOAD_v2 structure to embed both legitimate documents and malicious payloads, which are extracted and executed in memory sequentially. The malware injects shellcode into the explorer.exe process to deploy a RokRAT variant. RokRAT communicates with cloud-based command-and-control infrastructure via pCloud, Dropbox, and Yandex Cloud services. The campaign demonstrates advanced social engineering and evasion techniques, including process injection and cloud-hosted C2 operations. Attribution analysis links the campaign to APT37 based on infrastructure overlap, code similarities, and operational patterns. Indicators of compromise include specific IP addresses and a file hash. There is no known CVE or patch available for this threat.

The campaign enables remote attackers to execute malicious code on targeted systems through spear-phishing and multi-stage payload execution. RokRAT malware deployed via this attack can establish persistent access and communicate with cloud-based C2 servers, potentially leading to data exfiltration or further system compromise. The use of legitimate-looking documents and cloud services for command-and-control increases the difficulty of detection and mitigation.

No official patch or remediation is currently available for this threat. Defenders should be aware of spear-phishing tactics involving academic conference-themed lures and malicious ISO attachments containing disguised executables. Monitoring for the identified indicators of compromise, including the listed IP addresses and file hash, may assist in detection. Network monitoring for unusual traffic to cloud services such as pCloud, Dropbox, and Yandex Cloud is recommended. User awareness training to recognize spear-phishing attempts is advised. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources for updates.