Kaspersky describes ScarCruft as a Korean-speaking, allegedly state-sponsored actor targeting organizations linked to the Korean peninsula, with recent activity showing a multi-stage binary infection process. The chain used an initial dropper with UAC bypass, a downloader that fetched steganographically hidden payloads, and a cloud-service backdoor associated with ROKRAT that could steal data, take screenshots and audio, execute commands, and exfiltrate through Box, Dropbox, pCloud, and Yandex paths. Researchers also found a rare Bluetooth device harvester that collected connected, authenticated, and remembered device metadata through Windows Bluetooth APIs. Telemetry identified victims including investment and trading firms in Vietnam and Russia and diplomatic agencies in Hong Kong and North Korea, with overlap against DarkHotel and Konni activity around at least one Russia-based victim.