ScarCrufts_New_Language.pdf (6 MB)

S2W TALON attributes a postal-code update lure campaign against South Korean users to ChinopuNK, an internally tracked ScarCruft subgroup associated with Chinotto malware. The infection chain begins with a malicious LNK in a RAR archive, drops an AutoIt loader, and retrieves follow-on payloads including stealers, ransomware, and backdoors from external infrastructure. The toolset includes NubSpy using PubNub for C2, LightPeek, TxPyLoader, FadeStealer, VCD ransomware, and CHILLYCHINO, a Rust-based backdoor adapted from a PowerShell version. The activity matters for DPRK tracking because it shows ScarCruft expanding beyond espionage tradecraft into ransomware deployment, modern language ports, and continued abuse of real-time messaging platforms such as PubNub and Ably.