APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.123 North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
- FireEye APT37 Feb 2018
- Securelist ScarCruft Jun 2016
- Talos Group123
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | APT37 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | InkySquid | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | ScarCruft | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Reaper | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Group123 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TEMP.Reaper | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Ricochet Chollima | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1529 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1123 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1561.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.003 | Steganography | — |
| T1033 | System Owner/User Discovery | — |
| T1036.001 | Invalid Code Signature | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1057 | Process Discovery | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1120 | Peripheral Device Discovery | — |
| T1123 | Audio Capture | — |
| T1189 | Drive-by Compromise | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1529 | System Shutdown/Reboot | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1561.002 | Disk Structure Wipe | — |
| T1566.001 | Spearphishing Attachment | — |
Aliases
APT37 · Group123 · InkySquid · Reaper · Ricochet Chollima · ScarCruft · TEMP.Reaper
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.