Loading threat actor…
APT37 is a North Korean state-sponsored cyberespionage group active since at least 2012. It is also tracked as ScarCruft, Group123, Reaper, TEMP.Reaper, InkySquid, Ricochet Chollima, RedEyes, and TA RedAnt. Its principal objective is intelligence collection benefiting the North Korean regime. South Korea is its primary target, with operations also extending to Japan and Vietnam. Targets include public- and private-sector organizations, North Korean human-rights organizations, defectors, journalists, and researchers and specialists concerned with unification, defense, diplomacy, and North Korean affairs. Its intelligence interests include defense, aerospace, nuclear technology, and engineering. APT37 obtains initial access through tailored spearphishing, malicious Hangul Word Processor and Microsoft Office documents, Windows shortcuts distributed in archives, watering-hole attacks, and vulnerability exploitation. It impersonates trusted experts, organizational leaders, and conference organizers, frequently displaying legitimate decoy documents while executing staged payloads. Documented exploitation includes the Flash vulnerability CVE-2018-4878 and browser-engine vulnerabilities CVE-2020-1380, CVE-2021-26411, CVE-2022-41128, and CVE-2024-38178. In June 2024, it exploited CVE-2024-38178 through malicious advertisements rendered by legacy WebView components in South Korean software applications. The group extensively uses the ROKRAT backdoor for remote command execution, system reconnaissance, screenshot capture, document theft, and exfiltration. It has also deployed Bluelight and used Cobalt Strike in watering-hole operations. Its malware abuses legitimate cloud-storage APIs and Backend-as-a-Service platforms for command-and-control and data transfer, including Dropbox, pCloud, Yandex, OneDrive, and Back4app. Persistence mechanisms include Registry autostart entries and scheduled tasks. Defense evasion includes encrypted and obfuscated payloads, staged PowerShell and Ruby loaders, process injection, in-memory execution, sandbox and debugger checks, and deletion of intermediate artifacts. APT37 also conducts pre-compromise reconnaissance using email web beacons and benign-document exchanges to profile recipients and tailor subsequent attacks.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
65 malware families attributed to this actor across reporting.
60 additional families tracked in Mallory.
26 CVEs this actor has used in observed campaigns. 26 of them exploited in the wild.
과거에는 HWP 문서 취약점, SWF Flash Player 제로데이(CVE-2018-4878) 등 다양한 보안 취약점을 빠르게 선점해 실전 공격에 도입 적용했을 정도로 취약점 공격에 매우 능동적인 양상을 보였습니다.
The background section states that APT37 previously carried out various zero-day attacks, including exploitation of the Internet Explorer vulnerability CVE-2022-41128.
Tools Used by Group123: ... Flash Exploits, ... CVE-2016-4117 ...
2024-10-16 ⋅ AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) APT37
ZDI identified nearly 1,000 malicious .lnk files abusing ZDI-CAN-25373 (aka ZDI-25-148), a vulnerability that allows attackers to execute hidden malicious commands on a victim’s machine by leveraging crafted shortcut files.
21 more CVEs tied to this actor tracked in Mallory.
855 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Annotation-only mention; no actor-specific operation or behavior is described.
Listed as an annotation to a renamed-Python-binary detection; no actor-specific campaign or behavior is described.
Referenced only as an annotated actor associated with the detection technique.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.