Operation Capsule Vault Uses Malicious ISO Files and Process Injection to Deliver RokRAT

Operation Capsule Vault began with spear-phishing emails sent on June 22, 2026, posing as notices distributing materials from a legitimate academic event. The lures referenced the “Why Wonsan-Kalma Tourism Now?” conference, held at Seoul COEX on June 12, and incorporated publicly available event details, including its subject matter and host organizations. By reusing real-world conference […]

The post Operation Capsule Vault Uses Malicious ISO Files and Process Injection to Deliver RokRAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.