APT37
- ID
- G0067
- Associated names
- InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Techniques used (29)
- T1005 Data from Local System
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1033 System Owner/User Discovery
- T1036.001 Invalid Code Signature
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1120 Peripheral Device Discovery
- T1123 Audio Capture
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1529 System Shutdown/Reboot
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1555.003 Credentials from Web Browsers
- T1559.002 Dynamic Data Exchange
- T1561.002 Disk Structure Wipe
- T1566.001 Spearphishing Attachment
Software used (13)
- S0154 Cobalt Strike
- S0212 CORALDECK
- S0213 DOGCALL
- S0214 HAPPYWORK
- S0215 KARAE
- S0216 POORAIM
- S0217 SHUTTERSPEED
- S0218 SLOWDRIFT
- S0219 WINERACK
- S0240 ROKRAT
- S0247 NavRAT
- S0355 Final1stspy
- S0657 BLUELIGHT