Carbon Black examined ROKRAT, also known as DOGcall, a remote access trojan used by attackers originating from North Korea. The malware is commonly delivered by loaders or carrier files such as macro-enabled Office documents, injects shellcode into processes such as wscript.exe or cmd.exe, and then deletes the loader to reduce artifacts. Its payload profiles the victim system, performs anti-analysis checks, and provides RAT capabilities including additional tool deployment, data exfiltration, credential harvesting, and screenshot capture. Newer variants used cloud services such as pCloud, Dropbox, and Yandex for command and control, while earlier related variants used hard-coded URLs hosted largely by Korean telecoms and sometimes downloaded second-stage malware disguised as JPG files.