Recently, ScarCruft has been employing a new attack method to distribute ROKRAT using an HWP OLE-based Dropper/Loader structure, deviating from their traditional LNK-based attack chain.