Loading threat actor…
APT37 is a North Korean state-linked advanced persistent threat group associated with cyber espionage operations, particularly against South Korean targets and organizations connected to Korean Peninsula political, diplomatic, and human rights issues. Widely used aliases include Reaper, ScarCruft, Ricochet Chollima, InkySquid, Group123, and TEMP.Reaper. The group is known for targeted spearphishing as a primary initial access vector, including emails carrying malicious Hangul Word Processor documents and other lure attachments designed to induce user execution. Reported targeting has included South Korean civil society organizations, activists, journalists, and human rights defenders focused on North Korea-related issues, as well as entities with business or diplomatic relationships with South Korea. APT37 has also been linked to campaigns involving supply-chain compromise and Android surveillance tooling evolution associated with RambleOn. Observed tradecraft includes credential theft from web browsers through malware such as ZUMKONG; downloading second-stage payloads from compromised websites; collecting victim usernames, computer names, BIOS and host information; enumerating running processes through Windows APIs; using the command line and malicious scripts for execution; decoding payload components with VBA and shellcode; establishing persistence through scheduled tasks and Registry Run keys; using HTTPS for command-and-control concealment; performing process injection with VirtualAlloc, WriteProcessMemory, and CreateRemoteThread; and collecting data from local victim systems for exfiltration. The group’s activity profile is consistent with a disciplined espionage operator focused on intelligence collection and sustained access rather than financially motivated ransomware operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
55 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
44 malware families attributed to this actor across reporting.
39 additional families tracked in Mallory.
25 CVEs this actor has used in observed campaigns. 25 of them exploited in the wild.
Here are some of them: CVE-2018-4878 — Yes — Flash exploit used by APT37 and Lazarus
APT37 그룹은 과거에도 다양한 취약점을 활용해 공격을 수행했습니다. 대표적으로 인터넷 익스플로러(IE) Zero-Day 취약점이었던 'CVE-2022-41128' 사례가 있습니다. 2022년 10월 말... ‘용산 이태원 사고 대처상황’이라는 공문서를 사칭한 악성 DOCX 문서가 유포됐습니다.
2024-10-16 ⋅ AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178) APT37
Here are some of them: CVE-2016-4117 — Yes — Flash exploit used in watering hole attacks
The vulnerabilities below were attributed to APT37 by FireEye: CVE-2017-0199 — No — Microsoft Office/WordPad Remote Code Execution Vulnerability
20 more CVEs tied to this actor tracked in Mallory.
758 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned for comparison as another DPRK-linked actor known to use LNK-based attack techniques, including its own LNK builder in prior reporting.
Listed as a threat actor associated with the generic installation exploitation analytic, but no campaign-specific activity is described in this reference.
Assessed as highly likely responsible for Operation Capsule Vault, a spear-phishing campaign delivering a RokRAT variant against people in research, policy, and academic fields using Dropbox-hosted ISO files and a disguised PIF payload for in-memory execution and cloud-based C2.
Referenced as the threat actor associated with BirdCall malware in a post linking to an analysis of malware masquerading as Zangi Messenger.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.