Group123

Group123, also known as APT37, RedAnt, RedEyes, ScarCruft, Inky Squid, and Reaper, is a threat actor group associated with North Korea. This group has demonstrated a variety of technical capabilities in their intrusions, primarily targeting government entities. Mandiant Threat Intelligence and AhnLab Security Intelligence Center (ASEC) have identified Group123's alignment with the activity publicly reported as Scarcruft. The group's modus operandi includes using malicious shellcode located in images hosted on compromised websites, leveraging open platforms as command and control servers, and exploiting vulnerabilities in popular software. Recently, Group123 exploited an Internet Explorer zero-day vulnerability, tracked as CVE-2024-38178 (CVSS score 7.5), in a supply chain attack specifically targeting a Toast ad program that is usually installed alongside various free software. This approach closely aligns with Group123's previously observed and documented techniques over the past 18 months. The malware developer within the group appears to be a different individual, but the infection framework and operating mode remain consistent with Group123's known activities. There is medium confidence in the assessment that NavRAT, a malicious campaign, is linked to Group123. Despite the lack of non-obvious false flags in NavRAT, its connection to Group123 is supported by the similarities in execution and intent. However, it's important to note that these assessments are based on current available data and may change as further information becomes available.