APT37

APT37, also known as RedAnt, RedEyes, ScarCruft, and Group123, is a threat actor suspected to be backed by North Korea. It has been active since at least 2012, primarily targeting South Korea across various industry verticals such as chemicals, electronics, manufacturing, aerospace, automotive, and healthcare, with additional activities noted in Japan, Vietnam, and the Middle East. The group uses custom malware for espionage purposes and has access to destructive malware. Notably, APT37 has been consistently attributed to the ROKRAT malware, first reported by Talos in April 2017, which it employs in various campaigns. In recent attacks, APT37 utilized various infection chains and lures, resulting in payloads of ROKRAT and Amadey. The group has exploited vulnerabilities such as the one-click WPS Office bug, using it to deliver RokRAT without any user interaction required. This was specifically targeted at a Toast ad program typically installed alongside various free software. Additionally, the group exploited zero-day vulnerabilities in Microsoft's Internet Explorer Web browser, mounting a zero-click supply chain campaign on South Korean targets. These exploits were discovered by Google Threat Analysis Group researchers in late October 2022 and actively exploited by APT37 in December 2022. The severity of APT37's activities came to light in early February 2028 when researchers revealed that the group leveraged a zero-day vulnerability in Adobe Flash Player to deliver malware to South Korean users. The group tricked victims into downloading malware on their desktops with the Toast ad program installed. In February 2018, FireEye linked APT37 to the North Korean government based on several clues. The group's cyberattacks have mainly targeted government, defense, military, and media organizations in South Korea, posing significant threats to these sectors.