APT37

APT37, also known as ScarCruft, Reaper, or Group123, is a threat actor suspected to be linked to North Korea. It primarily targets South Korea but has also extended its activities to Japan, Vietnam, and the Middle East, focusing on various industry verticals such as chemicals, electronics, manufacturing, aerospace, automotive, and healthcare. The group was first reported by Talos in 2017 when it identified the ROKRAT malware, consistently attributed to APT37. Additionally, the group has access to destructive malware and uses custom malware for espionage purposes. The group was first discovered in 2021 and has been continually developing its malicious capabilities. In our report, we detail various infection chains and lures used by APT37 in their recent attacks, resulting in the deployment of payloads like ROKRAT and Amadey. The group has also developed a specific malware named CloudMensis, which seeks to identify where SIP is disabled to load its own malicious database. While another report provides a technical analysis of one of the ROKRAT campaigns, our report offers further insights into additional campaigns by APT37 and a deeper analysis of the ROKRAT malware. Over the past year, APT37 has been involved in significant cyber campaigns against Russia, including an attack on a Russian defense enterprise that resulted in a data leak. Despite Russia and North Korea's close ties, North Korean cyberespionage groups such as the Konni Group, Kimsuky Group, and APT37 have frequently targeted Russian government organizations. These activities indicate a complex and evolving threat landscape involving multiple actors and groups, with APT37 playing a crucial role.