Initial Access
2 techniques·derived
HWP Korean word-processor documents, near-universal in South Korean government use. Watering holes on defector-support and news sites.
APT37
Prolific browser zero-day developer, focused on South Korean targets and North Korean defectors.
- Active
- 2012–present
- Motivation
- Espionage
- Aliases
- 10
- Exploited CVEs
- 4
- ATT&CK techniques
- 10
- Cited sources
- 9
Overview
APT37, commonly reported as ScarCruft, is the most capable exploit developer in the DPRK's cyber apparatus. Where Kimsuky relies on social engineering and Lazarus on volume, APT37 repeatedly finds and weaponises browser and document zero-days.
It has burned Flash zero-days, Internet Explorer zero-days, and Windows kernel escalations — a research capability that is expensive to build and maintain, and which the group has consistently directed at a narrow target set rather than spending broadly.
That target set is politically sensitive: North Korean defectors and the organisations that resettle and support them, South Korean journalists covering DPRK affairs, human rights groups documenting conditions inside the country, and government and academic institutions working Korea policy. Reporting has also documented targeting of individuals connected to defector networks in Japan, Vietnam, and the Middle East.
The group's flagship implant, ROKRAT, is notable for using legitimate cloud services — Dropbox, Yandex Disk, pCloud, Google Drive — for both command and control and exfiltration. Traffic to these services is ordinary in most enterprises and encrypted by default, so the implant's network activity is close to indistinguishable from an employee syncing files.
Unusually for a DPRK group, APT37 is assessed as reporting to the Ministry of State Security rather than the Reconnaissance General Bureau.
Attribution
Down to the named unit where public evidence supports it.
North KoreaMSS — Ministry of State Security (assessed)Moderate confidence
Assessed as North Korean state-sponsored with high confidence by Mandiant/FireEye, based on malware development artifacts including North Korean IP addresses in build environments, Korean-language resources, and targeting exclusively aligned with DPRK interests. The specific attribution to the Ministry of State Security rather than the Reconnaissance General Bureau is an industry assessment rather than a government finding, and is held with lower confidence than the state-level attribution.
Attributing sources
Cross-vendor naming crosswalk
10 designators across 9 organisations.
2 designators are marked partial — the vendor's cluster overlaps this group but is not synonymous with it. Treating a partial correlation as an equivalence is the most common source of attribution error when pivoting between vendor reports.
MITRE ATT&CK
index ↗- APT37
Assigns a stable Gxxxx group ID and adopts the most widely used public name. Deliberately conservative — MITRE merges clusters only when public reporting supports it.
Microsoft Threat Intelligence
index ↗- Ruby SleetFormerly CERIUM
Weather-event family encodes the attributed origin; the adjective is arbitrary. Renamed from the older element taxonomy (STRONTIUM, NOBELIUM, HAFNIUM) in April 2023. 'Storm-####' is a temporary designator for a cluster still in development.
CrowdStrike
index ↗- Ricochet Chollima
Animal denotes attributed nation-state or motive; the adjective distinguishes clusters. The original public adversary taxonomy, in use since 2012.
Mandiant / Google Threat Intelligence
index ↗- APT37
- Reaper
APTxx for state-nexus espionage, FINxx for financially motivated, UNCxxxx ('uncategorized') for clusters not yet graduated to a named group. Many UNC numbers are later merged into an APT/FIN designator.
Secureworks CTU
index ↗- NICKEL FOXCROFT
Metal prefix encodes attributed origin, paired with an arbitrary uppercase codeword.
Palo Alto Networks Unit 42
index ↗- Velvet ChollimapartialBoundary between APT37 and Kimsuky clusters varies by vendor
Constellation denotes attributed origin or motive, adopted in 2023 to replace ad-hoc naming.
Kaspersky GReAT
index ↗- ScarCruft
Descriptive names, often coined from a distinctive string or artifact in the toolset.
Proofpoint
index ↗- TA-RedAntpartialAhnLab designator for an overlapping cluster
TA### ('Threat Actor'), numbered sequentially in order of first tracking.
CISA / NSA / FBI
index ↗- Group123Cisco Talos designator adopted in U.S. reporting
U.S. government advisories generally reference groups by the most common industry name plus the attributed unit. Joint advisories are the authoritative source for unit-level attribution.
Targeting
Target sectors
Target geography
South KoreaJapanVietnamRussiaKuwaitNepalChina
Tools & malware
Custom tooling is a strong clustering signal; shared and commodity tooling is not.
Custom / bespoke
ROKRATbackdoor
Flagship implant using Dropbox, Yandex Disk, pCloud, and Google Drive for C2 and exfiltration — network traffic indistinguishable from ordinary file sync.
Malpedia ↗GOLDBACKDOORbackdoor
Successor implant delivered via a multi-stage chain, used against journalists and defector organisations.
Chinottobackdoor
PowerShell and Windows backdoor with an Android counterpart, used for surveillance of individuals.
DOGCALL / KARAEbackdoor
Earlier implant families with cloud-service C2, supporting screenshots and audio capture.
Bluetooth harvesterutility
Module enumerating nearby Bluetooth devices — an unusual capability suggesting interest in physical proximity mapping.
RokRAT Android variantsmalware
Mobile implants targeting individuals' phones alongside desktop compromise.
Exploited vulnerabilities
Filtered on the date this actor was first reported exploiting the flaw — not the CVE's publication date.
| CVE | Product | Usage by APT37 | ||
|---|---|---|---|---|
| CVE-2024-381780-day | — | — | 1 May 2024 | Windows Scripting Engine memory corruption exploited as a zero-day via a compromised advertising server ('Code-on-Toast' campaign).SRCAhnLab / ROK NCSC ↗ |
| CVE-2022-411280-day | — | — | 31 Oct 2022 | Internet Explorer JScript engine zero-day delivered inside a Word document referencing the Itaewon crowd-crush disaster — exploiting a national tragedy for lure credibility days after it occurred.SRCGoogle Threat Analysis Group ↗ |
| CVE-2018-48780-dayKEVransomware | 9.8 | Adobe Flash PlayerAdobe | 31 Jan 2018 | Adobe Flash use-after-free exploited as a zero-day against South Korean targets, including individuals researching North Korea, prior to Adobe's patch.SRCCisco Talos ↗ |
| CVE-2017-0199KEVransomware | 7.8 | Microsoft OfficeMicrosoft | 1 May 2017 | OLE2link RTF exploit used to deliver ROKRAT in campaigns against South Korean targets.SRCCisco Talos ↗ |
Actors sharing exploited CVEs
Kill chain
How this actor moves through an intrusion, stage by stage, titled by ATT&CK tactic. Read left to right.
8 stages · 10 techniques
01 02 Execution
1 technique·derived
Repeated use of browser and document zero-days.
03 Persistence
1 technique·derived
Registry Run Keys.
04 Defense Evasion
1 technique·derived
Payloads concealed within image files.
05 Discovery
1 technique·derived
Bluetooth device enumeration.
06 Collection
2 techniques·derived
Screen Capture, Audio Capture.
07 Command and Control
1 technique·derived
Cloud storage services as C2 — the group's signature.
08 Exfiltration
1 technique·derived
Exfiltration to Cloud Storage.
Scroll horizontally · characteristic chain across documented operations, not a single incident
MITRE ATT&CK techniques
Grouped in kill-chain order.
10 techniques across 8 tactics · 6 with actor-specific notes
Initial Access
2- T1566.001Phishing: Spearphishing Attachment
HWP Korean word-processor documents, near-universal in South Korean government use
- T1189Drive-by Compromise
Watering holes on defector-support and news sites
Execution
1- T1203Exploitation for Client Execution
Repeated use of browser and document zero-days
Defense Evasion
1- T1027.003Obfuscated Files or Information: Steganography
Payloads concealed within image files
Discovery
1- T1120Peripheral Device Discovery
Bluetooth device enumeration
Collection
2Command and Control
1- T1102.002Web Service: Bidirectional Communication
Cloud storage services as C2 — the group's signature
Known to work with
Relationship type and confidence stated explicitly — 'related' without qualification is not an assessment.
Kimsuky🇰🇵 North Korea
Same sponsorHigh confidence
Overlapping target sets across South Korean policy and defector communities; distinct toolsets and, per assessment, different services.
Lazarus Group🇰🇵 North Korea
Same sponsorModerate confidence
Both DPRK state actors; APT37 assessed as MSS rather than RGB.
Primary-source reporting
Curated links to the reports that established what is known about this group.