S2W analyzes a December 2020 watering-hole attack tied to ScarCruft/APT37 that delivered Matryoshka, an evolved ROKRAT variant, to visitors of a North Korea-related website using a vulnerable Internet Explorer browser. The infection chain used a malicious script source, PowerShell, OneDrive-hosted Ruby components, multi-stage shellcode, and PE payloads disguised under legitimate driver-like paths before loading the final information stealer. The malware derived keys from the victim computer name, used AES-128-CBC and XOR routines, checked installed antivirus products, maintained persistence through Run keys, injected code into processes, and collected files, browser credentials, cookies, mail-client data, and FTP-client data. Command-and-control and exfiltration abused cloud services such as pCloud, Yandex, Box, Dropbox, and Backblaze, with the appendix providing tokens, hashes, and YARA rules for ScarCruft loaders and ROKRAT components.