apt37-reaper

• SKILL.mdcore · 24,521 bytes

# APT37 (Reaper, ScarCruft, Ricochet Chollima, InkySquid) — Adversary Emulation Profile

APT37 (MITRE ATT&CK **G0067**) is a North Korean state-sponsored cyber-espionage group active since at least 2012. Tracked as ScarCruft (Kaspersky), Reaper (FireEye), InkySquid (Volexity), Group123 (Cisco Talos), TEMP.Reaper, and Ricochet Chollima (CrowdStrike), APT37 primarily targets South Korean government, military, media, and defector communities, with expanding operations into Japan, Vietnam, the Middle East, and Europe. The group is characterized by aggressive exploitation of zero-day vulnerabilities in Adobe Flash Player, Internet Explorer, and Microsoft Edge; heavy use of weaponized Hangul Word Processor (HWP) documents; strategic web compromises (watering holes); a diverse custom malware arsenal (RoKRAT, BLUELIGHT, Chinotto, Dolphin, DOGCALL); and C2 over legitimate cloud services (Dropbox, pCloud, Yandex, Box, Google Drive). Unlike the higher-profile Lazarus Group, APT37 focuses on targeted intelligence collection and defector surveillance rather than financial theft or destructive operations.

## Attribution & motivation

- **Sponsor / nation:** Democratic People's Republic of Korea (North Korea) — Reconnaissance General Bureau (RGB). FireEye's 2018 report assessed APT37 as a North Korean state-sponsored group with "high confidence," based on malware compilation timestamps aligned with Pyongyang working hours (UTC+8:30/+9), Korean-language resources in binaries, targeting patterns consistent with DPRK state interests, and overlapping infrastructure with other attributed DPRK operations.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** — surveillance of North Korean defectors, journalists covering DPRK affairs, and human-rights activists; collection of South Korean military, government, and diplomatic intelligence. Secondary missions include **pre-positioning for destructive operations** (MBR-wiping malware capability) and **technology/defense intelligence collection** from aerospace, chemicals, electronics, and manufacturing sectors.
- **Attribution confidence:** **High.** FireEye's 2018 "APT37: The Overlooked North Korean Actor" report, Kaspersky's ScarCruft tracking (Operation Daybreak, Bluetooth harvester), Cisco Talos "Korea in the Crosshairs," Volexity's InkySquid browser-exploit research, and consistent multi-vendor reporting over a decade.

## Targeting

- **Sectors:** Government and diplomatic bodies; military and defense; media and journalism (specifically reporters covering North Korea); **North Korean defectors, refugees, and human-rights organizations**; chemicals, electronics, manufacturing, aerospace, automotive, and healthcare; academic and research institutions.
- **Regions:** Primary focus on **South Korea**; expanded since 2017 to **Japan, Vietnam, Middle East (Kuwait, other Gulf states), Russia (NPO Mashinostroyeniya breach), India, Nepal, Romania, Czech Republic, and Poland**.