APT37
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean…
- ATT&CK ID
- G0067
- Origin
- North Korea
- Techniques
- 25
- Tools
- 13
Also tracked as InkySquid · ScarCruft · Reaper · Group123 · TEMP.Reaper · Ricochet Chollima
Vulnerabilities it has exploited
- CVE-2016-4117 Adobe Flash PlayerUnscored · exploited in the wild
- CVE-2017-0199 Microsoft Office and WordPadUnscored · exploited in the wild
- CVE-2018-4878 Adobe Flash PlayerUnscored · exploited in the wild
- CVE-2020-1380 Microsoft Internet ExplorerUnscored · exploited in the wild
- CVE-2020-26411 Unscored
- CVE-2021-26411 Microsoft Internet ExplorerUnscored · exploited in the wild
Techniques
Initial Access
Execution
Scheduled Task/JobCommand and Scripting InterpreterNative APIExploitation for Client ExecutionUser ExecutionInter-Process Communication
Persistence
Scheduled Task/JobBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobProcess InjectionBoot or Logon Autostart ExecutionAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationMasqueradingProcess Injection
Credential Access
Credentials from Password Stores
Discovery
System Owner/User DiscoveryProcess DiscoverySystem Information DiscoveryPeripheral Device Discovery
Collection
Data from Local SystemAudio Capture
Command and Control
Application Layer ProtocolWeb ServiceIngress Tool Transfer
Impact
System Shutdown/RebootDisk Wipe
Software
BLUELIGHT · CORALDECK · Cobalt Strike · DOGCALL · Final1stspy · HAPPYWORK · KARAE · NavRAT · POORAIM · ROKRAT · SHUTTERSPEED · SLOWDRIFT · WINERACK