APT37 Reaper Targeted North Korean Defectors With Phishing and Custom Malware

Researchers reported that APT37/Reaper (also tracked as ScarCruft) ran a surveillance campaign against North Korean defectors in South Korea and human rights activists, using credential-harvesting phishing pages and malware-laced lures to collect intelligence. The operation impersonated services including Naver, iCloud, Kakao, Mail.ru, and 163.com, and some phishing pages were built to intercept credentials and evade or relay two-factor authentication flows through web-based communications channels.

Investigators found two exposed Reaper command-and-control servers that revealed both hosted malware and stolen victim data, providing a detailed view of the intrusion set. The campaign used CHM files for initial infection, PowerShell backdoors, modified DLL loaders, ExtremeVNC, and multiple Chinotto malware variants, including new Windows DLL samples identified as CKU and DATA, as well as an AblyGo backdoor, indicating ongoing tool development in a sustained North Korea-linked cyberespionage effort.