OTX Threat: Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2

A sophisticated spear-phishing campaign targeted individuals in research, policy, and academic fields through emails disguised as materials from an actual academic conference. The attack leveraged a cloud storage link delivering a malicious ISO file containing a PIF executable disguised as a PDF document. The multi-stage loader used EMBED_PAYLOAD_v2 structure to embed both legitimate documents and Sectors: Education, Government