RokRAT is a closed-source malware family believed to be used exclusively by the North Korean APT37 threat actor, which Volexity tracks as InkySquid. This threat actor compromised a news portal to use recently patched browser exploits to deliver a custom malware family known as BLUELIGHT. RokRAT is a backdoor previously attributed to use by ScarCruft/APT37, which is also known as InkySquid. In this case, it was a system belonging to an individual who is a frequent target of North Korean threat actors.