APT37Threat actor
- apt 37
- apt-c-28
- atk4
- g0067
- group 123
- group123
- inkysquid
- moldy pisces
- operation daybreak
- operation erebus
- plain neptune
- Reaper
- reaper group
- red eyes
- ricochet chollima
- ScarCruft
- temp.reaper
- venus 121
APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entitiesFrom MISP Galaxy
Last reported 1 month ago, by Silent Push8 reports
ATT&CK techniques
6 of 79 · each with the sentence it comes from- T1027Obfuscated Files or Information
“[T1027] Obfuscated files or information”
- T1082System Information Discovery
“[T1082] System information discovery”
- T1041Exfiltration Over C2 Channel
“[T1041] Exfiltration over C2 channel”
- T1056Input Capture
“Input Capture: Keylogging”
- T1056.001Keylogging
“T1056.001”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall“APT37's NarwhalRAT: New IOCs have been published related to APT37's NarwhalRAT and its May campaigns.”
-
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors“…ong-term espionage, the usage of simple xor-based encryption, custom substitution cipher, and the list of C2s hardcoded is associated to APT37 by ThreatFox and maltrail.”
-
Beyond Lazarus: How North Korea Organizes Its Cyber Operations“In line with the NIA (ex-MSS) mandate, the related threat cluster Reaper focuses on DPRK defectors, South Korean DPRK-focus activists and NGOs, acting as a secret police with cyber means.”
-
Reporte de Actividad APT del cuarto trimestre de 2025 al primero de 2026“En paralelo, ScarCruft comprometió una plataforma de gaming que presta servicio a la región de Yanbian en China, probablemente para recolectar inteligencia sobre individuos de interés para el régimen norcoreano, incluidos refugiados y desertores.”
-
ESET APT Activity Report Q4 2025–Q1 2026“In parallel, ScarCruft compromised a gaming platform serving the Yanbian region in China, likely to collect intelligence on individuals of interest to the North Korean regime, including refugees and defectors.”
-
ScarCruft compromete plataforma de juegos en ataque de cadena de suministro con fines de espionaje“ScarCruft compromete plataforma de juegos en ataque de cadena de suministro con fines de espionaje”
-
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack“A rigged game: ScarCruft compromises gaming platform in a supply-chain attack”
-
APT37 Adds New Capabilities for Air-Gapped Networks“APT37 Adds New Capabilities for Air-Gapped Networks”
Indicators in its reports
named in the reports above- hxxps://www.sqgame[.]netin 2 reports
- www.sqgame[.]netin 2 reports
- hxxps://www.sqgame[.]net/games/gamedownload.aspxin 2 reports
- hxxp://sqgame.com[.]cn/ybht.apkin 2 reports
- sqgame.com[.]cnin 2 reports
- 03e3ece9f48cf410…a2fb3c6b26cfin 2 reports
- hxxp://sqgame.com[.]cn/sqybhs.apkin 2 reports
- fc0c691db7e2d2bd…8df72168b7d9in 2 reports
- hxxp://xiazai.sqgame.com[.]cn/dating/20240429.zipin 2 reports
- xiazai.sqgame.com[.]cnin 2 reports
Copy these 10 indicators · defanged
Thanks — we review every report.