LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0067: APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

EnterpriseG0067GroupObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

APT37 is an ATT&CK group entry for a North Korean state-sponsored espionage actor with multiple aliases and reported targeting across South Korea and several other countries. Its ATT&CK relationships matter because they show a pattern defenders can plan around: backdoors/RATs, downloaders, an exfiltration tool, Cobalt Strike, command execution, discovery, persistence through scheduled tasks, obfuscation, and local data collection.

Executive priority

Treat this as a threat-intelligence planning object rather than a standalone detection rule. Leaders should ask whether sensitive business, government, research, financial, or regional operations matching the ATT&CK-described targeting have tested coverage for RAT/backdoor activity, document-delivered malware where relevant, suspicious scheduled tasks, script execution, and data collection before exfiltration. Because North Korean group naming overlaps in public reporting, prioritize behaviors and controls over alias-based attribution.

Technical view

MITRE provides no official detection text and no platforms on the group object itself, but relationships include many Windows-oriented tools such as DOGCALL, KARAE, POORAIM, SLOWDRIFT, ROKRAT, NavRAT, Final1stspy, and BLUELIGHT, plus Cobalt Strike and techniques covering execution, discovery, defense evasion, persistence, collection, and privilege-escalation-adjacent behavior. SOC and IR teams should validate detections around Windows command shell and Visual Basic execution, scheduled task creation/modification, process injection indicators, invalid code signatures, obfuscated or steganographic payloads, user/process discovery, local file collection, and RAT-like network behavior.

Likely telemetry

  • Endpoint process creation and command-line telemetry, especially cmd.exe and Visual Basic-related execution
  • Windows scheduled task creation, modification, and execution events
  • EDR memory/process injection alerts and cross-process activity metadata
  • File creation, archive/encryption indicators, suspicious media files, and invalid or misleading code-signature metadata
  • User and process discovery command telemetry

Detection direction

  • Do not rely on the APT37 name or aliases as the primary analytic key; map coverage to the related tools and techniques instead.
  • Tune for suspicious combinations: script or command execution followed by discovery, scheduled task persistence, obfuscated payload staging, local data access, and outbound RAT-like traffic.
  • Review allowlists and code-signing checks for binaries with invalid signatures or copied signature metadata, because visual trust can differ from cryptographic validation.
  • Account for false positives from administrators, software deployment tools, and legitimate scheduled tasks by baselining normal task names, paths, parent processes, and execution accounts.
  • Validate whether telemetry covers the Windows-heavy relationships while noting that some related ATT&CK techniques are cross-platform even though the group object lists no platforms.

Mitigation priorities

  • Prioritize endpoint visibility and response coverage for command execution, scheduled tasks, process injection, and suspicious file staging.
  • Harden script and command interpreter use through least privilege, application control, and administrative baselining where operationally feasible.
  • Enforce software patching and safe handling for document-processing applications relevant to the environment, including HWP where used.
  • Use egress controls, proxy/DNS logging, and anomaly review to make RAT and backdoor communications harder to hide.
  • Maintain sensitive-data handling, segmentation, and access controls so local data collection from a compromised host has limited business impact.
Additional notes and limits

The strongest defensive value comes from the relationship context: APT37 is linked to multiple backdoors/RATs, a downloader, an exfiltration tool, Cobalt Strike, and techniques for execution, discovery, evasion, persistence, and collection. The official description also warns that North Korean group definitions overlap, so attribution labels should be handled cautiously in reporting and incident decisions.

MITRE supplies no official detection guidance, no group-level tactics, and no group-level platforms for this object. The listed relationships support behavioral planning but do not prove activity in any specific environment, current exploitation, or guaranteed detection coverage. Local asset inventory, telemetry availability, regional exposure, and intelligence requirements are needed to assess priority.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

29 rows
DomainIDNameRelationship / procedure
EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.[1][3]

EnterpriseT1120Peripheral Device Discovery

APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. [4]

EnterpriseT1059.006PythonSub-technique

APT37 has used Python scripts to execute payloads.[5]

EnterpriseT1105Ingress Tool Transfer

APT37 has downloaded second stage malware from compromised websites.[1][4][6][5]

EnterpriseT1071.001Web ProtocolsSub-technique

APT37 uses HTTPS to conceal C2 communications.[3]

EnterpriseT1027.003SteganographySub-technique

APT37 uses steganography to send images to users that are embedded with shellcode.[3][4]

EnterpriseT1102.002Bidirectional CommunicationSub-technique

APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.[1][3]

EnterpriseT1082System Information Discovery

APT37 collects the computer name, the BIOS model, and execution path.[3]

EnterpriseT1204.002Malicious FileSub-technique

APT37 has sent spearphishing attachments attempting to get a user to open them.[1]

EnterpriseT1036.001Invalid Code SignatureSub-technique

APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”[2]

EnterpriseT1548.002Bypass User Account ControlSub-technique

APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.[4]

EnterpriseT1033System Owner/User Discovery

APT37 identifies the victim username.[3]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.[1]

EnterpriseT1529System Shutdown/Reboot

APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.[3]

EnterpriseT1005Data from Local System

APT37 has collected data from victims' local systems.[1]

EnterpriseT1559.002Dynamic Data ExchangeSub-technique

APT37 has used Windows DDE for execution of commands and a malicious VBS.[2]

EnterpriseT1106Native API

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.[3]

EnterpriseT1203Exploitation for Client Execution

APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.[2][1][3][6]

EnterpriseT1055Process Injection

APT37 injects its malware variant, ROKRAT, into the cmd.exe process.[3]

EnterpriseT1027Obfuscated Files or Information

APT37 obfuscates strings and payloads.[3][4][5]

EnterpriseT1189Drive-by Compromise

APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.[2][1][6]

EnterpriseT1057Process Discovery

APT37's Freenki malware lists running processes using the Microsoft Windows API.[3]

EnterpriseT1059Command and Scripting Interpreter

APT37 has used Ruby scripts to execute payloads.[5]

EnterpriseT1059.003Windows Command ShellSub-technique

APT37 has used the command-line interface.[1][3]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

APT37 delivers malware using spearphishing emails with malicious HWP attachments.[1][3][4]

EnterpriseT1123Audio Capture

APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.[1]

EnterpriseT1059.005Visual BasicSub-technique

APT37 executes shellcode and a VBA script to decode Base64 strings.[3]

EnterpriseT1053.005Scheduled TaskSub-technique

APT37 has created scheduled tasks to run malicious scripts on a compromised host.[5]

EnterpriseT1561.002Disk Structure WipeSub-technique

APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).[1][3]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
MalwareEnterprise

S0247: NavRAT

NavRAT is a remote access tool designed to upload, download, and execute files. It has been observed in attacks targeting South Korea. [1]

Windows
MalwareEnterprise

S0213: DOGCALL

DOGCALL is a backdoor used by APT37 that has been used to target South Korean government and military organizations in 2017. It is typically dropped using a Hangul Word Processor (HWP) exploit. [1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1120: Peripheral Device DiscoveryEnterpriseuses · TechniqueT1059.006: PythonEnterpriseuses · MalwareS0657: BLUELIGHTEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · MalwareS0212: CORALDECKEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1027.003: SteganographyEnterpriseuses · MalwareS0215: KARAEEnterpriseuses · MalwareS0218: SLOWDRIFTEnterpriseuses · TechniqueT1102.002: Bidirectional CommunicationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1036.001: Invalid Code SignatureEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1529: System Shutdown/RebootEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · MalwareS0240: ROKRATEnterpriseuses · TechniqueT1559.002: Dynamic Data ExchangeEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · MalwareS0217: SHUTTERSPEEDEnterpriseuses · TechniqueT1203: Exploitation for Client ExecutionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
2b373c2810d3dfc8...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundle2b373c2810d3…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  2. [2]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  3. [3]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  4. [4]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  5. [5]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  6. [6]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  7. [7]
    Unit 42 Nokki Oct 2018

    Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.

    Open source URL
  8. [8]
    Talos NavRAT May 2018

    Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.

    Open source URL
  9. [9]
    APT37

    (Citation: FireEye APT37 Feb 2018)

  10. [10]
    APT37

    (Citation: FireEye APT37 Feb 2018)

  11. [11]
    APT37

    (Citation: FireEye APT37 Feb 2018)

  12. [12]
    CrowdStrike Richochet Chollima September 2021

    CrowdStrike. (2021, September 30). Adversary Profile - Ricochet Chollima. Retrieved September 30, 2021.

    Open source URL
  13. [13]
    CrowdStrike Richochet Chollima September 2021

    CrowdStrike. (2021, September 30). Adversary Profile - Ricochet Chollima. Retrieved September 30, 2021.

    Open source URL
  14. [14]
    CrowdStrike Richochet Chollima September 2021

    CrowdStrike. (2021, September 30). Adversary Profile - Ricochet Chollima. Retrieved September 30, 2021.

    Open source URL
  15. [15]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  16. [16]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  17. [17]
    Group123

    (Citation: FireEye APT37 Feb 2018)

  18. [18]
    Group123

    (Citation: FireEye APT37 Feb 2018)

  19. [19]
    Group123

    (Citation: FireEye APT37 Feb 2018)

  20. [20]
    InkySquid

    (Citation: Volexity InkySquid BLUELIGHT August 2021)

  21. [21]
    InkySquid

    (Citation: Volexity InkySquid BLUELIGHT August 2021)

  22. [22]
    InkySquid

    (Citation: Volexity InkySquid BLUELIGHT August 2021)

  23. [23]
    Reaper

    (Citation: FireEye APT37 Feb 2018)

  24. [24]
    Reaper

    (Citation: FireEye APT37 Feb 2018)

  25. [25]
    Reaper

    (Citation: FireEye APT37 Feb 2018)

  26. [26]
    Ricochet Chollima

    (Citation: CrowdStrike Richochet Chollima September 2021)

  27. [27]
    Ricochet Chollima

    (Citation: CrowdStrike Richochet Chollima September 2021)

  28. [28]
    Ricochet Chollima

    (Citation: CrowdStrike Richochet Chollima September 2021)

  29. [29]
    ScarCruft

    (Citation: Securelist ScarCruft Jun 2016)(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft May 2019)

  30. [30]
    ScarCruft

    (Citation: Securelist ScarCruft Jun 2016)(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft May 2019)

  31. [31]
    ScarCruft

    (Citation: Securelist ScarCruft Jun 2016)(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft May 2019)

  32. [32]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  33. [33]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  34. [34]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  35. [35]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  36. [36]
    TEMP.Reaper

    (Citation: FireEye APT37 Feb 2018)

  37. [37]
    TEMP.Reaper

    (Citation: FireEye APT37 Feb 2018)

  38. [38]
    TEMP.Reaper

    (Citation: FireEye APT37 Feb 2018)

  39. [39]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  40. [40]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  41. [41]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  42. [42]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  43. [43]
    mitre-attackG0067
    Open source URL
  44. [44]
    mitre-attackG0067
    Open source URL
  45. [45]
    mitre-attackG0067
    Open source URL
  46. [46]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  47. [47]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  48. [48]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  49. [49]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  50. [50]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  51. [51]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  52. [52]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  53. [53]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  54. [54]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  55. [55]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  56. [56]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  57. [57]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  58. [58]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  59. [59]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  60. [60]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  61. [61]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  62. [62]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  63. [63]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  64. [64]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  65. [65]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  66. [66]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  67. [67]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  68. [68]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  69. [69]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  70. [70]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  71. [71]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  72. [72]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  73. [73]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  74. [74]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  75. [75]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  76. [76]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  77. [77]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  78. [78]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  79. [79]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  80. [80]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  81. [81]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  82. [82]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  83. [83]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  84. [84]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  85. [85]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  86. [86]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  87. [87]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  88. [88]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  89. [89]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  90. [90]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  91. [91]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  92. [92]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  93. [93]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  94. [94]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  95. [95]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  96. [96]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  97. [97]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  98. [98]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  99. [99]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  100. [100]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  101. [101]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  102. [102]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  103. [103]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  104. [104]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  105. [105]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  106. [106]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  107. [107]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  108. [108]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  109. [109]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  110. [110]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  111. [111]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  112. [112]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  113. [113]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  114. [114]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  115. [115]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  116. [116]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  117. [117]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  118. [118]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  119. [119]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  120. [120]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  121. [121]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  122. [122]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  123. [123]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  124. [124]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  125. [125]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  126. [126]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  127. [127]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  128. [128]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  129. [129]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  130. [130]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  131. [131]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  132. [132]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  133. [133]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  134. [134]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  135. [135]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  136. [136]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  137. [137]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  138. [138]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  139. [139]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  140. [140]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  141. [141]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  142. [142]
    Securelist ScarCruft May 2019

    GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.

    Open source URL
  143. [143]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  144. [144]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  145. [145]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  146. [146]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  147. [147]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  148. [148]
    Volexity InkySquid RokRAT August 2021

    Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.

    Open source URL
  149. [149]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  150. [150]
    Talos Group123

    Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.

    Open source URL
  151. [151]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
  152. [152]
    Unit 42 Nokki Oct 2018

    Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.

    Open source URL
  153. [153]
    FireEye APT37 Feb 2018

    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use