ASEC observed oversized LNK files targeting South Korean users connected to North Korea-related, military, unification, and education topics. The shortcuts execute PowerShell through CMD, drop a decoy document, and write viewer.dat, search.dat, and find.bat into the public folder. search.dat loads viewer.dat filelessly, resulting in RokRAT execution with cloud API C2 over pCloud, Yandex, and Dropbox while using a Googlebot-like User-Agent. RokRAT can run commands, collect directory and system information, remove startup artifacts, and upload collected data to the actor-controlled cloud storage.