APT37
APT37, also known as ScarCruft, Reaper, InkySquid, Ricochet Chollima, Group123, and TEMP.Reaper, is a North Korean state-sponsored threat actor linked to cyber-espionage activity. The group was first identified in 2016 and is described as targeting North Korean defectors, journalists covering North Korea-related issues, government entities, South Korean activists, media organizations, high-profile experts in North Korean affairs, and in some reporting Russian diplomatic and defense-related targets. Its operations initially focused on South Korea and later expanded to Japan, Vietnam, Russia, Nepal, and several countries in the Middle East. The reporting consistently describes APT37 as using spear-phishing for initial access, including lures impersonating Microsoft Account security notifications, cybersecurity advisories, think-tank invitations, and North Korea-related documents. Delivery methods include ZIP and RAR archives, malicious LNK shortcut files, HWP documents with embedded OLE objects, and staged batch or PowerShell scripts. Observed tradecraft includes hidden PowerShell execution, fileless or in-memory payload execution, scheduled-task persistence, victim username and system information collection, and use of HTTPS for command-and-control concealment. Malware and tooling associated with the group in the provided content include RokRAT, NarwhalRAT, FadeStealer, Chinotto, NubSpy, LightPeek, TxPyLoader, CHILLYCHINO, and VCD Ransomware. RokRAT was described in a March 2025 campaign dubbed Operation ToyBox Story targeting South Korean activists and North Korea-focused experts, using Dropbox API endpoints for command-and-control and exfiltration. NarwhalRAT was delivered through Microsoft-themed phishing and is described as a compiled Python-based RAT capable of keylogging, screenshot capture, audio recording, USB data collection, active-window collection, file upload, and remote command execution; it used Korean relay sites and the pCloud API as part of a dead-drop or multi-channel C2 architecture. Historical and related ScarCruft reporting also notes abuse of cloud and messaging services including Dropbox, pCloud, Yandex Cloud, PubNub, Ably, and Microsoft Graph API for command-and-control. The content also references a ScarCruft subgroup tracked by S2W as ChinopuNK, associated with Chinotto malware distribution and a campaign targeting South Korean users via a malicious LNK in a RAR archive. That campaign reportedly deployed a stealer, ransomware, and backdoor components, which researchers assessed as an evolution from ScarCruft’s traditionally espionage-focused activity.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Non-Governmental Organizations
- Academia & Research
- Military
Where they target
Geographies tied to known operations.
- 🇰🇷 South Korea
Where they're from
Attributed origin per open-source reporting.
- KP
Tradecraft
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
34 malware families attributed to this actor across reporting.
29 additional families tracked in Mallory.
Associated vulnerabilities
14 CVEs this actor has used in observed campaigns. 14 of them exploited in the wild.
Scarcruft ... Attack using Flash Zero Day (CVE-2016-4171, CVE-2018-4878)
ScarCruft exploits CVE-2020-1380 to compromise victims.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878)...
...used exploits for... Word (CVE-2017-0199)...
9 more CVEs tied to this actor tracked in Mallory.
Observables
165 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
North Korea-linked espionage group behind Operation ToyBox Story, targeting South Korean activists and North Korea-focused individuals using phishing and the RokRAT malware with Dropbox-based command-and-control.
Conducting a spear-phishing campaign targeting Korean users with Microsoft-themed security advisory lures to deliver the NarwhalRAT Python backdoor for espionage and information theft.
Conducting spear-phishing campaigns impersonating Microsoft security notifications to deliver NarwhalRAT via malicious ZIP/LNK attachments and a multi-stage infection chain.
Conducting spear-phishing campaigns impersonating Microsoft security alerts to deliver NarwhalRAT via ZIP archives containing malicious LNK files, using multi-stage Python-based loaders, scheduled-task persistence, in-memory execution, and multi-channel C2 including Korean relay sites and pCloud.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.