Tag: lnk-obfuscation

1 Attack Reports | 0 Vulnerabilities

Attack reports

Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2

A sophisticated Python-based RAT targeting Korean users through spear phishing emails disguised as Microsoft security alerts. The attack chain employs LNK files embedded in ZIP archives, BAT-based obfuscation, and multi-stage loaders culminating in NarwhalRAT deployment. This advanced malware featu…
rokrat
spear-phishing
anti-vm
pcloud
dead-drop-resolver
2026-06-15
korean-targeting
lnk-obfuscation
narwhalrat
python-backdoor
Published: June 15, 2026
Downloadable IOCs: 8
Click here to see more Attack Reports