Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT37 · Nation-state · assessed origin North Korea · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT37

  • APT 37
  • Group 123
  • Group123
  • InkySquid
  • Operation Daybreak
  • Operation Erebus
  • Reaper Group
  • Reaper

state sponsor · Korea (Democratic People's Republic of)MITRE G0067 ↗

APT37 — ATT&CK roseAP

attack rose · 29 techniques across 10 tactics

What changed

ledger · newest first
  1. —todaynew CVE7 new CVEs: CVE-2013-0808, CVE-2016-4117, CVE-2017-0199, CVE-2018-4878, CVE-2020-1380, CVE-2020-26411 +1 more

Analyst brief

misp-galaxy + mitre-attack

APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities

Observed targets (as stated by the sources)

3 countries · 2 sectors
South KoreaJapanVietnamAssessed origin: North Korea

assessed origin · North Koreaobserved targets · 3

countries · 3

  • South Korea
  • Japan
  • Vietnam

sectors · 2

  • Government
  • Private sector

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

29 techniques · 10 of 15 tactics

  1. Initial access

    2 techniques

  2. Execution

    9 techniques

  3. Persistence

    1 technique

  4. Privilege escalation

    1 technique

  5. Stealth

    4 techniques

  6. Credential access

    1 technique

  7. Discovery

    4 techniques

  8. Collection

    2 techniques

  9. Command and control

    3 techniques

  10. Impact

    2 techniques

select a technique

Arsenal

13 malware
Malware
Malware · 13ATT&CK
BLUELIGHTS0657 ↗
CORALDECKS0212 ↗
KARAES0215 ↗
SLOWDRIFTS0218 ↗
ROKRATS0240 ↗
SHUTTERSPEEDS0217 ↗
POORAIMS0216 ↗
HAPPYWORKS0214 ↗
Final1stspyS0355 ↗
Cobalt StrikeS0154 ↗
NavRATS0247 ↗
DOGCALLS0213 ↗
WINERACKS0219 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT37 is cited as exploiting

none on KEV
  1. CVE-2021-264112026-10-17
    1. “APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2020-13802026-10-17
    1. “APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2020-264112026-10-17
    1. “APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2017-01992026-10-17
    1. “APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “This document exploited a newer vulnerability, CVE-2017-0199. Group 123 used this vulnerability less than one month after its public disclosure.”

      cited as exploiting · source: blog.talosintelligence.com ↗ · 2026-10-17

    3. “This document exploited a newer vulnerability, CVE-2017-0199. Group 123 used this vulnerability less than one month after its public disclosure.”

      cited as exploiting · source: blog.talosintelligence.com ↗ · 2026-10-17

  5. CVE-2016-41172026-10-17
    1. “APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  6. CVE-2018-48782026-10-17
    1. “APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  7. CVE-2013-08082026-10-17
    1. “Group 123 has been known to use exploits (such as CVE-2013-0808) or scripting languages harnessing OLE objects.”

      cited as exploiting · source: blog.talosintelligence.com ↗ · 2026-10-17

    2. “Group 123 has been known to use exploits (such as CVE-2013-0808) or scripting languages harnessing OLE objects.”

      cited as exploiting · source: blog.talosintelligence.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023HWP Malware Using the Steganography Technique: RedEyes (ScarCruft)AhnLab ↗
  2. 2021North Korean APT InkySquid Infects Victims Using Browser ExploitsVolexity ↗
  3. 2018APT37 (Reaper): The Overlooked North Korean ActorFireEye ↗
  4. 2016Flash zero-day exploit deployed by the ScarCruft APT GroupKaspersky ↗
  5. 2016Operation DaybreakKaspersky ↗

Take it with you

keyless · no signup

References

19 sources
  1. 1.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-vic…
  2. 2.fireeye.com/blog/threat-research/2018/02/apt37-overlooked-north-ko…
  3. 3.www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf
  4. 4.blog.talosintelligence.com/2018/01/korea-in-crosshairs.html
  5. 5.twitter.com/mstoned7/status/966126706107953152
  6. 6.cfr.org/interactive/cyber-operations/apt-37
  7. 7.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-…
  8. 8.unit42.paloaltonetworks.com/unit42-freemilk-highly-targeted-spear-phishing-campaign
  9. 9.blog.talosintelligence.com/2018/01/korea-in-crosshairs.html
  10. 10.attack.mitre.org/groups/G0067
  11. +9 more in the JSON record

Track APT37 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.