# APT37: threat group profile

> APT37 is a threat group thought to operate from North Korea, with suspected state backing. Public reporting links it to 25 attack techniques, and to attacks on government and private sector organisations, with 3 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/apt37
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > APT37

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 25 (plus 15 sub-techniques) |
| Countries and victims named | 3 |
| Thought to operate from | North Korea |
| Suspected backing | North Korea |
| Other names | 16 |
| Public reports | 15 |

## Who is APT37?

APT37 is a threat group thought to operate from North Korea, with suspected state backing. Public reporting links it to 25 attack techniques, and to attacks on government and private sector organisations, with 3 countries and victims named.

### Also known as

APT 37, Group 123, Group123, InkySquid, Operation Daybreak, Operation Erebus, Reaper Group, Reaper, Red Eyes, Ricochet Chollima, ScarCruft, Venus 121, ATK4, G0067, Moldy Pisces, APT-C-28

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities

## How does APT37 attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 25 linked to APT37. Some techniques belong to more than one stage. Public reporting also lists 15 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (0)

- None linked in public reporting.

### 3. Getting in (2)

- T1189: Drive-by Compromise
- T1566: Phishing

### 4. Running code (6)

- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1106: Native API
- T1203: Exploitation for Client Execution
- T1204: User Execution
- T1559: Inter-Process Communication

### 5. Staying in (2)

- T1053: Scheduled Task/Job
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (4)

- T1053: Scheduled Task/Job
- T1055: Process Injection
- T1547: Boot or Logon Autostart Execution
- T1548: Abuse Elevation Control Mechanism

### 7. Hiding (3)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1055: Process Injection

### 8. Disabling defences (0)

- None linked in public reporting.

### 9. Stealing passwords (1)

- T1555: Credentials from Password Stores

### 10. Looking around (4)

- T1033: System Owner/User Discovery
- T1057: Process Discovery
- T1082: System Information Discovery
- T1120: Peripheral Device Discovery

### 11. Spreading (0)

- None linked in public reporting.

### 12. Gathering data (2)

- T1005: Data from Local System
- T1123: Audio Capture

### 13. Keeping contact (3)

- T1071: Application Layer Protocol
- T1102: Web Service
- T1105: Ingress Tool Transfer

### 14. Taking data out (0)

- None linked in public reporting.

### 15. Causing damage (2)

- T1529: System Shutdown/Reboot
- T1561: Disk Wipe

## Who does APT37 go after?

**Sectors:** Government, Private sector

**Countries and victims named:** Republic of Korea, Japan, Vietnam

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about APT37

- https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/
- https://www.fireeye.com/blog/threat-research/2018/02/apt37-overlooked-north-korean-actor.html
- https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf
- http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html
- https://twitter.com/mstoned7/status/966126706107953152
- https://www.cfr.org/interactive/cyber-operations/apt-37
- https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/
- https://unit42.paloaltonetworks.com/unit42-freemilk-highly-targeted-spear-phishing-campaign/
- https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html
- https://attack.mitre.org/groups/G0067/
- https://securelist.com/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/75082/
- https://securelist.com/operation-daybreak/75100/
- https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/
- https://threatpost.com/scarcruft-apt-group-used-latest-flash-zero-day-in-two-dozen-attacks/118642/
- https://unit42.paloaltonetworks.com/atoms/moldypisces/

## Frequently asked questions

### Who is APT37?

APT37 is a threat group thought to operate from North Korea, with suspected state backing. Public reporting links it to 25 attack techniques, and to attacks on government and private sector organisations, with 3 countries and victims named.

### Where is APT37 thought to be based?

Public reporting places APT37 as operating from North Korea, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does APT37 target?

In public reporting, sectors named include government and private sector, and 3 countries and victims are named, including Republic of Korea, Japan and Vietnam.

### How does APT37 attack?

Public reporting links APT37 to 25 attack techniques. Most of them are about running code, taking control and looking around.

### How do I know if APT37 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact