NOKKI is a modular remote access tool. The earliest observed attack using NOKKI was in January 2018. NOKKI has significant code overlap with the KONNI malware family. There is some evidence potentially linking NOKKI to APT37. - <https://attack.mitre.org/software/S0353/>

NavRAT is a remote access tool designed to upload, download, and execute files. It has been observed in attacks targeting South Korea. - <https://attack.mitre.org/software/S0247/>