APT37 — APT Profile
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.Description reproduced from MITRE ATT&CK. © The MITRE Corporation, reproduced and distributed with permission.
Also tracked as
InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima, Operation Daybreak, Operation Erebus, Reaper Group, Red Eyes, Venus 121, ATK4, G0067, Moldy Pisces, APT-C-28, PLAIN NEPTUNE
IntelFusions coverage (3)
- North Korean spies hid a backdoor inside a load balancer 2026-09-04 · Nation-State
- State-backed hackers hide attacks inside AI tools and trusted cloud apps 2026-07-14 · Nation-State
- APT37 Deploys Rust-Based Backdoor and Python Loader in Targeted Campaign Against South Korean Dissidents 2026-02-16 · Nation-State
Tools & malware
- apk.chinotto Mobile Malware
- apk.kevdroid Mobile Malware
- apk.kospy Mobile Malware
- BLUELIGHT Backdoor
- Cobalt Strike Adversary Simulation
- CORALDECK Backdoor
- DOGCALL Backdoor
- Final1stspy Infostealer
- HAPPYWORK Backdoor
- KARAE Backdoor
- NavRAT Backdoor
- POORAIM Backdoor
- ROKRAT Backdoor
- SHUTTERSPEED Backdoor
- SLOWDRIFT Backdoor
- win.bluelight Backdoor
- win.chinotto Backdoor
- win.final1stspy Infostealer
- win.freenki Backdoor
- win.goldbackdoor Backdoor
- win.konni Backdoor
- win.nokki Backdoor
- win.open_carrot Backdoor
- win.poohmilk Backdoor
- win.poorweb Backdoor
- win.rokrat Backdoor
- win.rustonotto Backdoor
- win.starcruft Backdoor
- win.unidentified_067 Backdoor
- WINERACK Backdoor
Vendor research
- Zscaler ThreatLabz Zscaler ThreatLabz
- Adversary Profile - Ricochet Chollima Crowdstrike
- APT37 (Reaper): The Overlooked North Korean Actor FireEye
- North Korean APT InkySquid Infects Victims Using Browser Exploits Volexity
- Korea In The Crosshairs Talos
- Operation Daybreak Securelist
- ScarCruft continues to evolve, introduces Bluetooth harvester Securelist
Countries linked to this actor
- North Korea origin
- South Korea targets