APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.123 North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
- FireEye APT37 Feb 2018
- Securelist ScarCruft Jun 2016
- Talos Group123
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1529 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1123 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1561.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.003 | Steganography | — |
| T1033 | System Owner/User Discovery | — |
| T1036.001 | Invalid Code Signature | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1057 | Process Discovery | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1120 | Peripheral Device Discovery | — |
| T1123 | Audio Capture | — |
| T1189 | Drive-by Compromise | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1529 | System Shutdown/Reboot | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1561.002 | Disk Structure Wipe | — |
| T1566.001 | Spearphishing Attachment | — |
别名
APT37 · Group123 · InkySquid · Reaper · Ricochet Chollima · ScarCruft · TEMP.Reaper
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。