Loading story…
ESET reported that ScarCruft—also tracked as APT37 or Reaper—used a previously undocumented Windows backdoor called Dolphin in intrusions targeting South Korea, including a 2021 watering-hole attack against a South Korean online newspaper. The malware was delivered as a selective second-stage payload through a multistage loader chain that used a downloaded Python 2.7 interpreter, XOR-encrypted shellcode, process injection, and persistence via Run registry keys and a scheduled task.
Dolphin used Google Drive for command-and-control and data exfiltration and supported file theft from fixed, removable, and portable drives, keylogging, screenshots, shell command and shellcode execution, and browser credential theft. ESET said earlier variants also altered victims’ signed-in Google and Gmail security settings to maintain inbox access through IMAP and less secure app access, while later versions added evasion features such as dynamic API resolution and string obfuscation and temporarily removed credential-stealing functions; the activity was observed from April 2021 through January 2022 and attributed to the North Korea-aligned espionage group’s long-running focus on South Korean and other regional targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
ESET published analysis of Dolphin on November 30, 2022, describing it as a previously unreported ScarCruft backdoor that used Google Drive for command-and-control and exfiltration. The report linked the malware to ScarCruft/APT37 and detailed its espionage-focused capabilities against South Korean targets.
From April 2021 through January 2022, ESET observed several Dolphin variants with feature additions and evasion changes, including dynamic API resolution, string obfuscation, and temporary removal of credential-stealing capabilities. Earlier versions also altered Google and Gmail security settings to help preserve access to victims' email accounts.
In 2021, ScarCruft used Dolphin in a watering-hole attack targeting visitors to a South Korean online newspaper. The operation delivered the backdoor through a multistage loader chain involving Python, encrypted shellcode, process injection, and persistence mechanisms.
ESET observed ScarCruft deploying multiple versions of the previously unreported Dolphin backdoor starting in April 2021. The malware was used as a selective second-stage payload after initial compromise and showed ongoing development over time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked **ScarCruft** (`APT37`, also known as Reaper) compromised the `sqgame[.]net` gaming platform used by ethnic Koreans in China’s Yanbian region and used it to distribute the **BirdCall** backdoor in a supply-chain espionage campaign. ESET said the operation was likely active from late 2024, with the website compromised since at least November 2024, and assessed that the targets were likely North Korean defectors, refugees, and other people of interest to the regime in the Yanbian border area. The attackers appear to have tampered with the platform’s distribution infrastructure rather than stolen game source code, serving benign initial downloads and later malicious updates from the official site rather than Google Play. The campaign affected both **Android** and **Windows** users. Trojanized Android game APKs delivered a newly documented mobile BirdCall variant capable of stealing contacts, SMS messages, call logs, documents, media files, and private keys, while also taking screenshots and recording ambient audio; researchers identified at least seven Android versions. On Windows, a malicious desktop client update used a trojanized `mono.dll` to fetch **RokRAT**, which then deployed the Windows BirdCall payload with broader surveillance features such as keystroke logging, clipboard theft, and shell execution. ESET said the malware blended command-and-control traffic into normal HTTPS activity and relied primarily on **Zoho WorkDrive** for exfiltration, while also using compromised South Korean websites to host payloads and configuration data.
Jul 14, 2026
Varonis Threat Labs reported that **Dolphin X**, a Windows information stealer and remote-access trojan sold on a cybercrime forum by the actor **"Kontraktnik,"** is designed to harvest data from more than 300 applications. Advertised targets include browser passwords, enterprise credentials, cryptocurrency wallets, password managers, `.env` files, SSH keys, cloud tokens, and other DevOps secrets, creating risk for both personal accounts and corporate cloud environments. Researchers said the malware is offered in multiple subscription tiers and appears tailored for broad credential theft rather than simple consumer-focused infostealing. The operation stands out for an **"AI Profiler"** in its operator panel that scores infected users by likely value based on installed software, browsing activity, and application usage, helping criminals prioritize the most profitable victims. Varonis also found that builds are compiled remotely through `backend.thedolphinx[.]top:8443` and can use mutation features such as PE rewriting, import-table shuffling, control-flow rewriting, and string re-encryption to frustrate signature-based detection. While the researchers analyzed the builder, panel, and network traffic rather than a live malware sample, they assessed many of the advertised capabilities as credible and advised defenders to reduce long-lived credentials stored on disk and rely more heavily on behavior-based detection.
Jul 27, 2026
North Korean-linked **Kimsuky** has been linked to an ongoing spear-phishing campaign that impersonates diplomatic personnel and targets people involved in diplomacy and the education sector. According to AhnLab, the attackers used decoy diplomatic documents and malicious **`.lnk`** files to launch embedded **HTA** or **PowerShell** scripts, leading to the deployment of multiple payloads including the **PebbleDash** backdoor and **PrxClient** proxy malware. Additional tooling reportedly included downloaders, keyloggers, **RDP Wrapper**, RDP patching utilities, and UAC bypass tools such as **UACMe** and **SspiUacBypass**. The intrusions were designed to establish durable remote access and steal information from compromised Windows systems. AhnLab said the attackers created persistence through scheduled tasks, enabled or created backdoor accounts, modified RDP behavior to allow multi-session remote access, and in one PebbleDash variant stored configuration data in the registry before injecting into **LSASS**. The campaign also used scripts to collect local files and system information, capture keystrokes, and exfiltrate stolen data to command-and-control servers.
Jul 23, 2026