360 attributed a Korea-targeted malicious document campaign to APT-C-28, also known as ScarCruft or APT37, based on its RokRat payload and similarity to earlier public reporting. The captured Korean-language lure masqueraded as a payment application form; enabling macros dynamically decoded a second macro, bypassed VBOM checks, created a mutex, and injected first-stage shellcode into Notepad. The shellcode retrieved encrypted content from attacker-controlled cloud storage, decoded a second-stage shellcode, and loaded a December 2022 RokRat build in memory. The report notes changes in this RokRat version, including AV process checks, modified cleanup and persistence commands, expanded system-information collection, and use of cloud services such as OneDrive rather than Box.