ROKRAT
Software · ATTACK:enterprise:S0240
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0240",
"title": "ROKRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0240",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--60a9c2f0-b7a5-4e8e-959c-e1a3ff314a5f",
"external_id": "S0240",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2025-04-25T14:43:33.037Z",
"version": "2.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ROKRAT"
},
{
"source_name": "Talos ROKRAT",
"url": "https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
},
{
"source_name": "Talos Group123",
"url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"
},
{
"source_name": "Volexity InkySquid RokRAT August 2021",
"url": "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
},
{
"source_name": "Talos ROKRAT 2",
"url": "https://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
}
]
}Explicit source assertions (31)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ae212be-c07b-4f62-8c5e-9dfc0472254e
Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e8f2301-2758-43b3-8b3e-615281100eff
Securelist ScarCruft May 2019ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2de4d7df-18fc-4202-93ee-2fcfe6f2e501
Talos Group123ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--352953e9-c1ca-4d25-84b6-eb05a012b2e9
Talos Group123ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--366c4cf9-7ea1-4751-9415-bcd3a1c52b27
Volexity InkySquid RokRAT August 2021 · Talos ROKRATATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44b2a372-1aee-4a7e-a544-2aacdfe3121a
Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4eb00375-3ee3-43c7-845a-2206e1eff114
Malwarebytes RokRAT VBA January 2021 · Talos Group123 · NCCGroup RokRat Nov 2018ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--536ed2f4-46c5-4485-998c-60f0480d5c21
Talos ROKRAT · NCCGroup RokRat Nov 2018ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53c8de3e-f862-44d5-be7e-274e14bdd57e
NCCGroup RokRat Nov 2018ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68a15e63-2f89-4828-8be3-4494d7ff36e3
Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f3b9887-80cb-4b36-b228-91e360d83962
Talos Group123ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78617eb0-f679-48ad-82ca-3a85d0f9371e
Volexity InkySquid RokRAT August 2021ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0240
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7aea964a-cd9b-471e-bc7b-2a270c974289
Talos Group123 · Securelist ScarCruft May 2019ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ccf3e90-8099-4445-b39f-956d2807189b
Talos ROKRATATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8328f7af-8b66-45fd-89dc-2833fa37af23
Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83f5442e-74c1-4e7b-83d8-9c254543bbac
Volexity InkySquid RokRAT August 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a41eff0-83f3-414a-af49-54f0f8c1b84a
Volexity InkySquid RokRAT August 2021 · Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8bbe5f67-f65e-4982-8897-7f7466fc0845
Malwarebytes RokRAT VBA January 2021 · Talos Group123 · NCCGroup RokRat Nov 2018ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90be71e4-6b38-4411-aac5-09711a334393
Securelist ScarCruft May 2019 · NCCGroup RokRat Nov 2018 · Volexity InkySquid RokRAT August 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--921b3245-0795-40cd-82e1-04f38bc42b14
Talos ROKRAT · NCCGroup RokRat Nov 2018 · Volexity InkySquid RokRAT August 2021 · Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--959092cf-5647-4c25-b64e-3e84061511a5
Volexity InkySquid RokRAT August 2021 · Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b45c7b78-55c7-4418-ab03-9f805de7376d
Talos ROKRAT · Securelist ScarCruft May 2019 · Volexity InkySquid RokRAT August 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4f662d6-7e47-4161-bf8d-dd445ae901b1
Talos ROKRAT · Talos ROKRAT 2 · Securelist ScarCruft May 2019 · NCCGroup RokRat Nov 2018 · Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c78a0329-8160-40d2-83f4-f5076671e786
Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc470da4-82b7-4efb-aa09-f3e7402291df
Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfc92bbe-4a8b-47ec-b12d-d08fdcea1fbb
Talos ROKRAT · Talos ROKRAT 2 · Securelist ScarCruft May 2019 · NCCGroup RokRat Nov 2018 · Volexity InkySquid RokRAT August 2021 · Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1285ef9-fb7b-4d9b-9915-0b033e768a52
Talos ROKRATATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1a17f31-c62f-4ec3-9a77-41e6a339a657
NCCGroup RokRat Nov 2018 · Volexity InkySquid RokRAT August 2021 · Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d764b3d2-8ca3-437b-abe4-f54662ccce42
Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7d9a45b-0f61-43a0-93fd-7924c9307f72
Malwarebytes RokRAT VBA January 2021 · Volexity InkySquid RokRAT August 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f22106b0-ca8c-45ad-b20c-5a5ddd7bf886
Talos ROKRAT · NCCGroup RokRat Nov 2018 · Malwarebytes RokRAT VBA January 2021