Group123

Group123, also known as Inky Squid or APT37, is a threat actor group suspected of executing malicious cyber activities. They are known for their technical capabilities and innovative intrusion techniques. Over the past 18 months, they have been associated with a series of attacks that utilize shellcode similar to their previous campaigns. The final payload in these attacks is typically malicious shellcode hidden in an image hosted on a compromised website, with the authors using open platforms as command-and-control (C2) servers. Their primary targets appear to be government entities. NavRAT is a malware campaign that has been linked to Group123 with medium confidence. The malware developer for NavRAT is believed to be a different person within Group123's team, but the infection framework and operating mode align closely with the group's known tactics. Despite lacking non-obvious false flags, there is sufficient evidence to suggest that NavRAT is not related to non-Group123 actors. This assessment is based on the similarities in the approach and execution of the attacks. Mandiant Threat Intelligence has reported that APT37 is aligned with Scarcruft and Group123 activities. As we delve deeper into the Korean malware landscape, questions persist about possible links with Group123. However, due to the consistent alignment of attack methodologies and target selection, it is assessed with medium confidence that NavRAT and other associated campaigns can be attributed to Group123. This group continues to pose a significant threat, particularly to government targets, and requires ongoing vigilance.