The North Korean advanced persistent threat (APT) actor dubbed ScarCruft is using weaponized Microsoft Compiled HTML Help (CHM) files to download additional malware. According to multiple reports fromAhnLab Security Emergency response Center(ASEC),SEKOIA.IO, andZscaler, the development is illustrative of the group’s continuous efforts to refine and retool its tactics to sidestep detection. "