APT37
1
linked CVEs
Also known as
APT 37Group 123Group123InkySquidOperation DaybreakOperation ErebusReaper GroupReaperRed EyesRicochet ChollimaScarCruftVenus 121ATK4G0067Moldy PiscesAPT-C-28TEMP.Reaper
Targeted industries
GovernmentPrivate sector
APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities
Source: misp_galaxy · Collected: 2026-08-08
⚡ Vulnerabilities & Exploits1 CVE
threat_actor_cve → cves / exploits.cve_ids
| CVE-2016-4171 suspected | Unspecified vulnerability in Adobe Flash Player allows for remote code execution. | KEV |
🔍 Detection Coverage0 Sigma
Derived from linked CVEs — not a direct actor match
No Sigma rules mapped via this actor's CVEs yet.
🧬 YaraComing soon
MITRE ATT&CK Techniques Used29 techniques
Across 10 tactics
Collection2 techniques
T1005Data from Local System
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to…
T1123Audio Capture
An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening…
Command And Control3 techniques
T1071.001Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and…
T1102.002Bidirectional Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may…
T1105Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network th…
Credential Access1 technique
Discovery4 techniques
T1033System Owner/User Discovery
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example,…
T1057Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within th…
T1082System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this informatio…
T1120Peripheral Device Discovery
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macO…
Execution9 techniques
T1053.005Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The […
T1059Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common featu…
T1059.003Windows Command Shell
Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows…
T1059.005Visual Basic
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://a…
T1059.006Python
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactiv…
T1106Native API
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, suc…
T1203Exploitation for Client Execution
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior.…
T1204.002Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This us…
T1559.002Dynamic Data Exchange
Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applicat…
Impact2 techniques
T1529System Shutdown/Reboot
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or networ…
T1561.002Disk Structure Wipe
Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to s…
Initial Access2 techniques
T1189Drive-by Compromise
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., [Drive-by Target](https…
T1566.001Spearphishing Attachment
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing att…
Persistence2 techniques
T1053.005Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The […
T1547.001Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause th…
Privilege Escalation4 techniques
T1053.005Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The […
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address spa…
T1547.001Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause th…
T1548.002Bypass User Account Control
Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from l…
Stealth4 techniques
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavi…
T1027.003Steganography
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks,…
T1036.001Invalid Code Signature
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the deve…
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address spa…
🛰️ Infrastructure & IOCs48
| domain | webhostingkorea.com | — | 2026-07-15 |
| domain | www.novel21.co.kr | — | 2026-07-15 |
| domain | fe01.co.kr | — | 2026-07-15 |
| md5 | 3715092aa00f380cefe8b4d2eddb7d08 | — | 2026-07-15 |
| md5 | 7cef19f9c4480adac0cd4702ff98f46c | — | 2026-07-15 |
| md5 | 7eb9cee1f696727752169f25cf79a338 | — | 2026-07-15 |
| md5 | b6b0602310bb2d4360c52685119aac1b | — | 2026-07-15 |
| url | http://www.novel21.co.kr/data/editor/2110/index.php | — | 2026-07-15 |
| domain | novel21.co.kr | — | 2026-07-15 |
| domain | crwellfood.com | — | 2026-07-15 |
| ip | 5.180.208.57 | — | 2026-07-13 |
| ip | 5.180.208.60 | — | 2026-07-13 |
| ip | 160.238.37.95 | — | 2026-07-13 |
| ip | 89.147.101.197 | — | 2026-07-13 |
| ip | 160.238.37.100 | — | 2026-07-13 |
| md5 | e5c9bb3938f2a24e755ee39073fc3aca | — | 2026-07-13 |
| ip | 89.187.161.220 | — | 2026-07-13 |
| sha1 | b06110e0feb7592872e380b7e3b8f77d80dd1108 | — | 2026-05-05 |
| sha1 | fc0c691db7e2d2bd3b0b4c1e24d18df72168b7d9 | — | 2026-05-05 |
| ip | 114.108.128.157 | — | 2026-05-05 |
| ip | 211.239.117.117 | — | 2026-05-05 |
| ip | 221.143.43.214 | — | 2026-05-05 |
| ip | 222.231.2.20 | — | 2026-05-05 |
| ip | 222.231.2.23 | — | 2026-05-05 |
| ip | 222.231.2.41 | — | 2026-05-05 |
| ip | 39.106.249.68 | — | 2026-05-05 |
| url | http://sqgame.com.cn/sqybhs.apk | — | 2026-05-05 |
| url | http://sqgame.com.cn/ybht.apk | — | 2026-05-05 |
| url | http://xiazai.sqgame.com.cn/dating/20240429.zip | — | 2026-05-05 |
| url | https://ipinfo.io/json | — | 2026-05-05 |
| url | https://www.sqgame.net | — | 2026-05-05 |
| url | https://www.sqgame.net/games/gamedownload.aspx | — | 2026-05-05 |
| domain | 1980food.co.kr | — | 2026-05-05 |
| domain | cndsoft.co.kr | — | 2026-05-05 |
| domain | colorncopy.co.kr | — | 2026-05-05 |
| domain | inodea.com | — | 2026-05-05 |
| domain | sejonghaeun.com | — | 2026-05-05 |
| domain | sqgame.com.cn | — | 2026-05-05 |
| domain | swr.co.kr | — | 2026-05-05 |
| domain | www.lawwell.co.kr | — | 2026-05-05 |
| sha1 | 01a33066fbc6253304c92760916329abd50c3191 | — | 2026-05-05 |
| sha1 | 03e3ece9f48cf4104aafc535790ca2fb3c6b26cf | — | 2026-05-05 |
| sha1 | 2b81f78ec4c3f8d6cf8f677d141c5d13c35333af | — | 2026-05-05 |
| sha1 | 409c5acaed587f62f7e23da47f72c4d9ec3144d9 | — | 2026-05-05 |
| sha1 | 59a9b9d47ae36411b277544f25ad2cc955d8dd2c | — | 2026-05-05 |
| sha1 | 7356d7868c81499fb4e720f7c9530e5763b4c1d0 | — | 2026-05-05 |
| sha1 | 95bdb94f6767a3cce6d92363bbf5bc84b786bdb0 | — | 2026-05-05 |
| md5 | a8fe823d451d636d0a0366c0629ef5c3 | — | 2026-05-05 |
📰 Threat Intel Coverage4
Digest reports mentioning this actor (incl. aliases)
| ESET APT Activity Report Q4 2025–Q1 2026 | matched as ScarCruft | 2026-05-28 |
| A rigged game: ScarCruft compromises gaming platform in a supply-chain attack | matched as Reaper | 2026-05-05 |
| A rigged game: ScarCruft compromises gaming platform in a supply-chain attack | matched as ScarCruft | 2026-05-05 |
| ZDI-CAN-25373: Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns | matched as APT37 | 2025-03-21 |