APT37

APT37 is a North Korea-linked state-sponsored cyber espionage group active primarily against South Korean targets, while also targeting organizations and individuals of broader strategic interest. Widely tracked under aliases including ScarCruft, Reaper, Ricochet Chollima, InkySquid, TA-RedAnt, Group123, and TEMP.Reaper, the group is associated with intelligence collection operations focused on government, defense, policy, academic, research, media, and North Korea-related communities. APT37 is known for sustained spear-phishing and social-engineering campaigns that use highly tailored lures, including academic events, security notices, and politically relevant themes. The group has repeatedly targeted South Korean users and professionals with document-themed malware delivery, malicious shortcut files, disguised executables, and archive or disk-image based infection chains. Reported operations have also used social platforms and messaging applications to build rapport with targets before delivering malware. The group is strongly associated with the RokRAT malware family and related tooling, as well as campaigns involving NarwhalRAT, BirdCall, Rustonotto, Chinotto, FadeStealer, and RoKRAT variants. Its malware commonly performs host reconnaissance, document theft, screen capture, command execution, keylogging, microphone recording, and broader remote-control functions. APT37 has also demonstrated interest in removable media and air-gapped or network-separated environments, including use of LNK-based initial compromise, USB-mediated command delivery and exfiltration, and cloud-backed command-and-control patterns intended to bypass segmentation. A defining characteristic of APT37 tradecraft is abuse of legitimate cloud and web services for command and control, staging, and exfiltration. Public reporting has linked the group to use of services such as Dropbox, pCloud, Yandex Cloud, and Zoho WorkDrive, enabling blending with normal traffic and resilient multi-channel C2. The group has also used memory-resident loaders, shellcode stages, process injection into legitimate processes, decoy documents, and persistence mechanisms such as Registry Run keys and scheduled tasks. Recent reporting has tied APT37 to campaigns such as Operation Capsule Vault, in which a RokRAT variant was delivered through spear-phishing aimed at research, policy, and academic personnel using a real conference lure and a multistage in-memory loader. Other reported activity includes targeting North Korea-related professionals in South Korea with Rustonotto, Chinotto, and FadeStealer; use of NarwhalRAT for surveillance and collection; and operations abusing legitimate software themes and cloud APIs for stealthy post-compromise control. APT37 has also been publicly linked to exploitation of Microsoft and browser vulnerabilities, including reported use of a Windows zero-day in 2024 against South Korean users via malicious advertising, although some such exploit attributions remain uncorroborated in public reporting. Overall, APT37 is best characterized as a persistent DPRK espionage actor that combines tailored social engineering, malware innovation, cloud-service abuse, and stealthy post-exploitation techniques to collect intelligence from South Korean and related strategic targets.