APT37· North Korea

APT37 (ScarCruft) is a KP-originated cyber espionage group targeting government sectors mainly in South Korea, Japan, and Vietnam.

Analyst brief

APT37 (ScarCruft) is a KP-originated nation-state group active since at least 2012, targeting government and private sectors mainly in South Korea, Japan, and Vietnam. The group typically gains initial access via drive-by compromise (T1189) and malicious files (T1204.002), followed by Python-based execution (T1059.006). Defenders should focus on TTPs like credential theft from web browsers (T1555.003), audio capture (T1123), and steganography (T1027.003) for stealth, as well as the use of known malware such as ROKRAT and Cobalt Strike.

APT37

APT 37Group 123Group123

nation-state

APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities

origin (suspected)

North Korea· state-sponsoredattribution confidence: medium (50)

target countries (as stated by the source)

South KoreaJapanVietnam

target sectors

GovernmentPrivate sector

techniques · ATT&CK

Drive-by Compromise Python Malicious File Registry Run Keys / Startup Folder Bypass User Account Control Steganography Invalid Code Signature Credentials from Web Browsers+8

malware

BLUELIGHT CORALDECK KARAE SLOWDRIFT ROKRAT SHUTTERSPEED+6

source: misp-galaxy + mitre-attackG0067 19 refs →

Kill-chain playbook10

01
initial-access
T1189
Implement web traffic monitoring and user education to prevent Drive-by Compromise.
02
execution
T1059.006 T1204.002
Perform endpoint monitoring and content inspection to detect malicious Python scripts and files.
03
persistence
T1547.001
Monitor and restrict changes to Registry Run Keys and Startup Folder.
04
privilege-escalation
T1548.002
Elevate User Account Control (UAC) settings to a secure level and monitor for bypass attempts.
05
stealth
T1027.003 T1036.001
Use code signature validation and Steganography detection tools to identify suspicious files.
06
credential-access
T1555.003
Harden browser security settings to protect credentials from being obtained from web browsers.
07
discovery
T1082 T1120
Monitor System Information Discovery and Peripheral Device Discovery activities and flag unusual behavior.
08
collection
T1005 T1123
Monitor endpoint activity to detect Data from Local System and Audio Capture activities.
09
command-and-control
T1071.001 T1105
Monitor network traffic to detect suspicious Web Protocols activity and Ingress Tool Transfer.
10
impact
T1529 T1561.002
Ensure protection of critical systems and data to prevent impact such as System Shutdown/Reboot and Disk Structure Wipe.

FAQ2

Which countries does APT37 primarily target?

APT37 primarily targets government and private sectors in South Korea, Japan, and Vietnam.

What methods does APT37 use for initial access?

The group typically gains initial access via drive-by compromise (T1189) and malicious files (T1204.002).

APT37· North Korea

Analyst brief

APT37

Kill-chain playbook10

initial-access

execution

persistence

privilege-escalation

stealth

credential-access

discovery

collection

command-and-control

impact

FAQ2

See also5

APT37· North Korea

Analyst brief

APT37

Kill-chain playbook10

initial-access

execution

persistence

privilege-escalation

stealth

credential-access

discovery

collection

command-and-control

impact

FAQ2

See also5