APT37, also known as ScarCruft or RedEyes, is described as a North Korean espionage group that mainly targets South Korea and has also operated across Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and the Middle East. The advisory links APT37 to RokRAT and Goldbackdoor, and says RedEyes expanded from CHM malware disguised as a Korean financial security email to RokRAT delivery through LNK files. RokRAT uses PowerShell launched from LNK content, collects machine data for target selection, communicates through cloud services such as Dropbox, pCloud, Yandex Cloud, and OneDrive, and supports additional payload execution and data exfiltration. The IOC set includes multiple hashes tied to the LNK and RokRAT activity, including 89c0d2cc1e71b17449eec454161d60da and 707e8cb56f32209ca837f2853801256cd3490ed2cc4b3428dc5e4238848f226d.