MITRE ATT&CKgroup

G0067 APT37

Published 2018-04-18 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima
Version
2.0
Created
2018-04-18

Description

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Related

Uses · MITRE ATT&CK (42)

  • S0657 BLUELIGHT software (malware)
  • T1071.001 Web Protocols sub-technique
  • T1102.002 Bidirectional Communication sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1059.006 Python sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1561.002 Disk Structure Wipe sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1559.002 Dynamic Data Exchange sub-technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1027.003 Steganography sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1529 System Shutdown/Reboot technique
  • S0355 Final1stspy software (malware)
  • S0240 ROKRAT software (malware)
  • S0247 NavRAT software (malware)
  • S0212 CORALDECK software (malware)
  • S0213 DOGCALL software (malware)
  • S0214 HAPPYWORK software (malware)
  • S0215 KARAE software (malware)
  • S0216 POORAIM software (malware)
  • S0217 SHUTTERSPEED software (malware)
  • S0218 SLOWDRIFT software (malware)
  • S0219 WINERACK software (malware)
  • T1189 Drive-by Compromise technique
  • T1203 Exploitation for Client Execution technique
Show all 42 ›

References