APT37 — APT Profile
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.Also tracked as
InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima
Tools & malware
- apk.chinotto Mobile Malware
- apk.kevdroid Mobile Malware
- apk.kospy Mobile Malware
- BLUELIGHT Backdoor
- Cobalt Strike Adversary Simulation
- CORALDECK Backdoor
- DOGCALL Backdoor
- Final1stspy Infostealer
- HAPPYWORK Backdoor
- KARAE Backdoor
- NavRAT Backdoor
- POORAIM Backdoor
- ROKRAT Backdoor
- SHUTTERSPEED Backdoor
- SLOWDRIFT Backdoor
- win.bluelight Backdoor
- win.chinotto Backdoor
- win.final1stspy Infostealer
- win.freenki Backdoor
- win.goldbackdoor Backdoor
- win.konni Backdoor
- win.nokki Backdoor
- win.open_carrot Backdoor
- win.poohmilk Backdoor
- win.poorweb Backdoor
- win.rokrat Backdoor
- win.rustonotto Backdoor
- win.starcruft Backdoor
- win.unidentified_067 Backdoor
- WINERACK Backdoor
Vendor research
- Zscaler ThreatLabz Zscaler ThreatLabz
- Adversary Profile - Ricochet Chollima Crowdstrike
- APT37 (Reaper): The Overlooked North Korean Actor FireEye
- North Korean APT InkySquid Infects Victims Using Browser Exploits Volexity
- Korea In The Crosshairs Talos
- Operation Daybreak Securelist
- ScarCruft continues to evolve, introduces Bluetooth harvester Securelist