NuriLab analyzes a new RokRAT malware report associated with APT37, a North Korea-linked threat group also discussed alongside Kimsuky, Moonstone Sleet, and Lazarus in the source context. The report says APT37 impersonates North Korea-related experts and uses spear phishing against people and organizations connected to North Korea issues. It is relevant for defenders tracking RokRAT delivery, APT37 social-engineering themes, and DPRK collection activity against regional policy and specialist communities.