{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "apt37",
    "slug": "apt37",
    "name": "APT37",
    "shortName": "APT37",
    "country": "North Korea",
    "countryCode": "KP",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2012",
    "prominence": 78,
    "mitreGroupId": "G0067",
    "malpediaSlug": "apt37",
    "tagline": "Prolific browser zero-day developer, focused on South Korean targets and North Korean defectors.",
    "bio": "APT37, commonly reported as ScarCruft, is the most capable exploit developer in the DPRK's cyber apparatus. Where Kimsuky relies on social engineering and Lazarus on volume, APT37 repeatedly finds and weaponises browser and document zero-days.\n\nIt has burned Flash zero-days, Internet Explorer zero-days, and Windows kernel escalations — a research capability that is expensive to build and maintain, and which the group has consistently directed at a narrow target set rather than spending broadly.\n\nThat target set is politically sensitive: North Korean defectors and the organisations that resettle and support them, South Korean journalists covering DPRK affairs, human rights groups documenting conditions inside the country, and government and academic institutions working Korea policy. Reporting has also documented targeting of individuals connected to defector networks in Japan, Vietnam, and the Middle East.\n\nThe group's flagship implant, ROKRAT, is notable for using legitimate cloud services — Dropbox, Yandex Disk, pCloud, Google Drive — for both command and control and exfiltration. Traffic to these services is ordinary in most enterprises and encrypted by default, so the implant's network activity is close to indistinguishable from an employee syncing files.\n\nUnusually for a DPRK group, APT37 is assessed as reporting to the Ministry of State Security rather than the Reconnaissance General Bureau.",
    "attribution": {
      "sponsor": "North Korea",
      "service": "MSS — Ministry of State Security (assessed)",
      "confidence": "moderate",
      "summary": "Assessed as North Korean state-sponsored with high confidence by Mandiant/FireEye, based on malware development artifacts including North Korean IP addresses in build environments, Korean-language resources, and targeting exclusively aligned with DPRK interests. The specific attribution to the Ministry of State Security rather than the Reconnaissance General Bureau is an industry assessment rather than a government finding, and is held with lower confidence than the state-level attribution.",
      "sources": [
        {
          "org": "Mandiant / FireEye",
          "title": "APT37 (Reaper): The Overlooked North Korean Actor",
          "url": "https://services.google.com/fh/files/misc/rpt-apt37.pdf",
          "date": "2018-02-20"
        },
        {
          "org": "Kaspersky GReAT",
          "title": "ScarCruft continues to evolve, introduces Bluetooth harvester",
          "url": "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/",
          "date": "2019-05-13"
        }
      ]
    },
    "motivations": [
      "espionage"
    ],
    "targetSectors": [
      "Government",
      "Media & Journalism",
      "NGO & Civil Society",
      "Defense",
      "Think Tanks & Academia",
      "Healthcare",
      "Manufacturing",
      "Transportation"
    ],
    "targetCountries": [
      "South Korea",
      "Japan",
      "Vietnam",
      "Russia",
      "Kuwait",
      "Nepal",
      "China"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "APT37",
        "url": "https://attack.mitre.org/groups/G0067/",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Ruby Sleet",
        "correlation": "exact",
        "note": "Formerly CERIUM"
      },
      {
        "org": "crowdstrike",
        "name": "Ricochet Chollima",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "APT37",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "Reaper",
        "correlation": "exact"
      },
      {
        "org": "kaspersky",
        "name": "ScarCruft",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "NICKEL FOXCROFT",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "Group123",
        "correlation": "exact",
        "note": "Cisco Talos designator adopted in U.S. reporting"
      },
      {
        "org": "unit42",
        "name": "Velvet Chollima",
        "correlation": "partial",
        "note": "Boundary between APT37 and Kimsuky clusters varies by vendor"
      },
      {
        "org": "proofpoint",
        "name": "TA-RedAnt",
        "correlation": "partial",
        "note": "AhnLab designator for an overlapping cluster"
      }
    ],
    "tools": [
      {
        "name": "ROKRAT",
        "type": "backdoor",
        "custom": true,
        "description": "Flagship implant using Dropbox, Yandex Disk, pCloud, and Google Drive for C2 and exfiltration — network traffic indistinguishable from ordinary file sync.",
        "malpediaSlug": "win.rokrat"
      },
      {
        "name": "GOLDBACKDOOR",
        "type": "backdoor",
        "custom": true,
        "description": "Successor implant delivered via a multi-stage chain, used against journalists and defector organisations."
      },
      {
        "name": "Chinotto",
        "type": "backdoor",
        "custom": true,
        "description": "PowerShell and Windows backdoor with an Android counterpart, used for surveillance of individuals."
      },
      {
        "name": "DOGCALL / KARAE",
        "type": "backdoor",
        "custom": true,
        "description": "Earlier implant families with cloud-service C2, supporting screenshots and audio capture."
      },
      {
        "name": "Bluetooth harvester",
        "type": "utility",
        "custom": true,
        "description": "Module enumerating nearby Bluetooth devices — an unusual capability suggesting interest in physical proximity mapping."
      },
      {
        "name": "RokRAT Android variants",
        "type": "malware",
        "custom": true,
        "description": "Mobile implants targeting individuals' phones alongside desktop compromise."
      }
    ],
    "techniques": [
      {
        "tCode": "T1203",
        "name": "Exploitation for Client Execution",
        "tactic": "Execution",
        "note": "Repeated use of browser and document zero-days"
      },
      {
        "tCode": "T1566.001",
        "name": "Phishing: Spearphishing Attachment",
        "tactic": "Initial Access",
        "note": "HWP Korean word-processor documents, near-universal in South Korean government use"
      },
      {
        "tCode": "T1189",
        "name": "Drive-by Compromise",
        "tactic": "Initial Access",
        "note": "Watering holes on defector-support and news sites"
      },
      {
        "tCode": "T1102.002",
        "name": "Web Service: Bidirectional Communication",
        "tactic": "Command and Control",
        "note": "Cloud storage services as C2 — the group's signature"
      },
      {
        "tCode": "T1567.002",
        "name": "Exfiltration Over Web Service: Exfiltration to Cloud Storage",
        "tactic": "Exfiltration"
      },
      {
        "tCode": "T1113",
        "name": "Screen Capture",
        "tactic": "Collection"
      },
      {
        "tCode": "T1123",
        "name": "Audio Capture",
        "tactic": "Collection"
      },
      {
        "tCode": "T1027.003",
        "name": "Obfuscated Files or Information: Steganography",
        "tactic": "Defense Evasion",
        "note": "Payloads concealed within image files"
      },
      {
        "tCode": "T1547.001",
        "name": "Boot or Logon Autostart Execution: Registry Run Keys",
        "tactic": "Persistence"
      },
      {
        "tCode": "T1120",
        "name": "Peripheral Device Discovery",
        "tactic": "Discovery",
        "note": "Bluetooth device enumeration"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2018-4878",
        "firstExploited": "2018-01-31",
        "zeroDay": true,
        "usage": "Adobe Flash use-after-free exploited as a zero-day against South Korean targets, including individuals researching North Korea, prior to Adobe's patch.",
        "source": {
          "org": "Cisco Talos",
          "title": "Group 123 Goes Wild",
          "url": "https://blog.talosintelligence.com/2018/02/group-123-goes-wild.html",
          "date": "2018-02-02"
        }
      },
      {
        "cveId": "CVE-2022-41128",
        "firstExploited": "2022-10-31",
        "zeroDay": true,
        "usage": "Internet Explorer JScript engine zero-day delivered inside a Word document referencing the Itaewon crowd-crush disaster — exploiting a national tragedy for lure credibility days after it occurred.",
        "source": {
          "org": "Google Threat Analysis Group",
          "title": "Internet Explorer 0-day exploited by North Korean actor APT37",
          "url": "https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37/",
          "date": "2022-12-07"
        }
      },
      {
        "cveId": "CVE-2024-38178",
        "firstExploited": "2024-05-01",
        "zeroDay": true,
        "usage": "Windows Scripting Engine memory corruption exploited as a zero-day via a compromised advertising server ('Code-on-Toast' campaign).",
        "source": {
          "org": "AhnLab / ROK NCSC",
          "title": "TA-RedAnt zero-day exploitation via toast advertisement program",
          "url": "https://asec.ahnlab.com/en/",
          "date": "2024-10-17"
        }
      },
      {
        "cveId": "CVE-2017-0199",
        "firstExploited": "2017-05-01",
        "usage": "OLE2link RTF exploit used to deliver ROKRAT in campaigns against South Korean targets.",
        "source": {
          "org": "Cisco Talos",
          "title": "Introducing ROKRAT",
          "url": "https://blog.talosintelligence.com/2017/04/introducing-rokrat.html",
          "date": "2017-04-03"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "kimsuky",
        "type": "same-sponsor",
        "confidence": "high",
        "note": "Overlapping target sets across South Korean policy and defector communities; distinct toolsets and, per assessment, different services."
      },
      {
        "relatedActorId": "lazarus",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both DPRK state actors; APT37 assessed as MSS rather than RGB."
      }
    ],
    "reports": [
      {
        "org": "Mandiant / FireEye",
        "title": "APT37 (Reaper): The Overlooked North Korean Actor",
        "url": "https://services.google.com/fh/files/misc/rpt-apt37.pdf",
        "date": "2018-02-20"
      },
      {
        "org": "Google Threat Analysis Group",
        "title": "Internet Explorer 0-day exploited by North Korean actor APT37",
        "url": "https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37/",
        "date": "2022-12-07"
      },
      {
        "org": "Kaspersky GReAT",
        "title": "ScarCruft continues to evolve, introduces Bluetooth harvester",
        "url": "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/",
        "date": "2019-05-13"
      }
    ],
    "campaigns": [],
    "flag": "🇰🇵",
    "profile": "/apt/apt37/"
  }
}