Loading threat actor…
APT-C-37, also known as Pat-Bear, is a suspected advanced persistent threat cluster that has been reported using mobile malware within broader espionage-oriented operations. The group has been linked to use of SpyNote, an Android remote access trojan also known as SpyMax and CypherRat, indicating an ability to target mobile devices in addition to more traditional intrusion tradecraft. Reported lures associated with the cluster include Arabic-language shortcut files disguised as government forms, suggesting socially engineered delivery tailored to regional victims. Observed tooling associated with APT-C-37 supports extensive post-compromise surveillance and collection on Android devices, including theft of SMS messages, contacts, call records, files, stored account data, location information, and keystrokes, as well as abuse of Accessibility Services for privilege expansion, interface interaction, screen monitoring, and persistence. SpyNote-based operations attributed in reporting to this cluster and peer actors have relied on trojanized applications, manual installation, permission abuse, persistent command-and-control communications, and obfuscation to evade analysis and detection. APT-C-37 has been mentioned alongside other state-linked or suspected state-linked actors such as OilRig and Kimsuky in reporting on SpyNote usage. Available information in this dataset supports characterization of APT-C-37 as an espionage-oriented threat actor with mobile surveillance capability, but does not provide high-confidence evidence for a specific national origin, a defined organizational structure, or confirmed ransomware activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 malware family attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as an example of a known actor associated with Arabic-language lure documents disguised as government forms in targeted campaigns.
Explicitly cited as a threat actor that has included SpyNote in its tooling portfolio during operations against high-value targets.
Explicitly identified as a group that has leveraged SpyNote in malicious campaigns against critical sectors and individuals.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.