APT37 Phishing Campaign Uses LNK Files and PowerShell to Deploy NarwhalRAT

Researchers reported that APT37 targeted Korean users with spear-phishing emails posing as urgent Microsoft Account Team messages and cybersecurity advisories, delivering ZIP archives that contained malicious .lnk files. The shortcut files abused native Windows tools including cmd, PowerShell, and curl.exe to fetch a decoy document and staged payloads, ultimately installing NarwhalRAT, a Python-based remote access trojan compiled from Python code. Genians linked the activity to Korea-focused infrastructure and artifacts, including references to naverwhale, KakaoTalk-related handling, and Korean relay servers.

Once installed, NarwhalRAT established persistence through a scheduled task disguised as a Microsoft task, performed anti-VM checks, and enabled broad surveillance and control functions such as keylogging, screen capture, microphone recording, file transfer, USB data collection, and remote command execution. The malware used a dual command-and-control design that combined Korean relay domains with the pCloud API as a dead-drop resolver, complicating detection and tracking. Researchers urged defenders to strengthen EDR coverage for suspicious LNK-to-PowerShell execution chains, unusual scheduled task creation, unexpected curl.exe activity, and silent Python execution.