NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT

Palo Alto Unit 42by Josh GrunzweigAug 17, 2026 · 12:23 UTC (Aug 17, 2026)9 min read1

AI summary · glm-5.3-flashSummaries by Vani AI

Unit 42 links NOKKI malware to North Korea's Reaper group, uncovering the Final1stspy dropper that deploys the DOGCALL RAT in politically motivated attacks.

Unit 42 analyzed the NOKKI malware family used in politically themed attacks against Russian and Cambodian speakers since July 2018. The researchers linked NOKKI to the Reaper group, publicly attributed to North Korea, whose custom DOGCALL RAT uses third-party hosting services to upload data and receive commands. A previously unreported family, Final1stspy, was found deploying DOGCALL, sharing a unique base64-to-hex deobfuscation routine with NOKKI droppers. Attacks used malicious Microsoft Word macros that download and execute payloads while opening decoy documents.

Key facts

NOKKI delivered via Word macros using base64-to-hex string obfuscation
Shared deobfuscation routine ties NOKKI droppers to Final1stspy, which deploys DOGCALL
DOGCALL RAT uses third-party hosting services for data exfiltration and commands
Reaper group targets South Korean defense and Middle Eastern organizations
Lures include World Cup predictions and North Korea political topics

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

ATT&CK: T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

Tags: dogcall final1stspy nokki north-korea rat reaper unit42

Vendors: Palo Alto Networks
Threat actors: Reaper
Malware: NOKKI DOGCALL Final1stspy
Organizations: Unit 42
Countries: North Korea South Korea Cambodia Russia

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
domain	nitesbr1.org	nload a VBScript file from the following URL: http:// kmbr1.nitesbr1[.]org/UserFiles/File/image/home.html This VBScript file yet aga
md5	05d43d417a8f50e7b23246643fc7e03d	After decryption, the following payload was identified: MD5 05d43d417a8f50e7b23246643fc7e03d SHA1 67c05b3937d94136eda4a60a2d5fb685abc776a1 SHA256 3fee06
md5	0f1d3ed85fee2acc23a8a26e0dc12e0f	tion is provided after it is decrypted by the malware): MD5 0f1d3ed85fee2acc23a8a26e0dc12e0f SHA1 3d161de48d3f4da0aefff685253404c8b0111563 SHA256 fb94a5
md5	a2fe5dcb08ae8b72e8bc98ddc0b918e7	oject(20180108)\Final1stspy\LoadDll\Release\LoadDll.pdb MD5 a2fe5dcb08ae8b72e8bc98ddc0b918e7 SHA1 741dbdb20d1beeb8ff809291996c8b78585cb812 SHA256 0669c7
md5	e02024f38dfb6290ce0d693539a285a9	was identified. This file had the following properties: MD5 e02024f38dfb6290ce0d693539a285a9 SHA1 d13fc918433c705b49db74c91f56ae6c0cb5cf8d SHA256 66a0c2
sha1	3d161de48d3f4da0aefff685253404c8b0111563	by the malware): MD5 0f1d3ed85fee2acc23a8a26e0dc12e0f SHA1 3d161de48d3f4da0aefff685253404c8b0111563 SHA256 fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6
sha1	67c05b3937d94136eda4a60a2d5fb685abc776a1	d was identified: MD5 05d43d417a8f50e7b23246643fc7e03d SHA1 67c05b3937d94136eda4a60a2d5fb685abc776a1 SHA256 3fee068bf90ffbeb25549eb52be0456609b1decfe91cda1967eb
sha1	741dbdb20d1beeb8ff809291996c8b78585cb812	lease\LoadDll.pdb MD5 a2fe5dcb08ae8b72e8bc98ddc0b918e7 SHA1 741dbdb20d1beeb8ff809291996c8b78585cb812 SHA256 0669c71740134323793429d10518576b42941f9eee0def6057ed
sha1	d13fc918433c705b49db74c91f56ae6c0cb5cf8d	owing properties: MD5 e02024f38dfb6290ce0d693539a285a9 SHA1 d13fc918433c705b49db74c91f56ae6c0cb5cf8d SHA256 66a0c294ee8f3507d723a376065798631906128ce79bd6dfd8f0
sha256	0669c71740134323793429d10518576b42941f9eee0def6057ed9a4ba87a3a9a	b918e7 SHA1 741dbdb20d1beeb8ff809291996c8b78585cb812 SHA256 0669c71740134323793429d10518576b42941f9eee0def6057ed9a4ba87a3a9a File Type PE32 executable (DLL) (GUI) Intel 80386, for MS W
sha256	3fee068bf90ffbeb25549eb52be0456609b1decfe91cda1967eb068ef2c8918f	c7e03d SHA1 67c05b3937d94136eda4a60a2d5fb685abc776a1 SHA256 3fee068bf90ffbeb25549eb52be0456609b1decfe91cda1967eb068ef2c8918f File Type PE32 executable (GUI) Intel 80386, for MS Windows
sha256	66a0c294ee8f3507d723a376065798631906128ce79bd6dfd8f025eda6b75e51	a285a9 SHA1 d13fc918433c705b49db74c91f56ae6c0cb5cf8d SHA256 66a0c294ee8f3507d723a376065798631906128ce79bd6dfd8f025eda6b75e51 Creator Windows User Created Date 2018-03-19 07:58:00 UTC L
sha256	fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6fd43c143fb3a	c12e0f SHA1 3d161de48d3f4da0aefff685253404c8b0111563 SHA256 fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6fd43c143fb3a File Type PE32 executable (GUI) Intel 80386, for MS Windows

From the original article

9 min read at unit42.paloaltonetworks.com

Recently, Unit 42 identified the NOKKI malware family that was used in attacks containing politically-motivated lures targeting Russian and Cambodian speaking individuals or organizations. As part of this research, an interesting tie was discovered to the threat actor group known as Reaper .

Palo Alto Unit 42

By Josh Grunzweig · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.