Loading threat actor…
APT37, also known as Vedalia, is a North Korea-linked espionage threat actor. The group has been associated with the early adoption of legitimate cloud services for command-and-control, including use of the Microsoft Graph API and Microsoft OneDrive to blend malicious traffic with normal enterprise cloud activity. APT37 developed the BlueLight malware family, including a second-stage payload capable of communicating with multiple cloud services for command-and-control. Variants of BlueLight have been documented using the Graph API to interact with OneDrive. This tradecraft reflects an emphasis on stealth, abuse of trusted platforms, and post-compromise persistence within victim environments. Based on available reporting, APT37 is best characterized as a state-linked cyber-espionage actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
North Korea-linked espionage group cited as an early adopter of cloud-service-based C2 via the BlueLight malware.
Espionage group linked to early use of Microsoft Graph API for command-and-control via OneDrive using the Bluelight payload.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.