SentinelLabs observed a campaign by ScarCruft actors targeting media organizations and high-profile experts in North Korean affairs. As part of the attack, the group impersonated a North Korea Research Institute member, used the RokRAT backdoor, and harvested threat intelligence from their targets. A modern-day TIP providing contextual and operational intelligence by automatically enriching, and correlating the IOCs, shall help organizations protect their network proactively.
