APT37

Executive Summary

APT37 is a North Korean state-sponsored cyber espionage group active since at least 2012. Known for its sophisticated campaigns targeting South Korea and other countries across Asia and the Middle East, APT37 employs a wide range of tactics to steal sensitive information. The group has demonstrated a particular focus on healthcare, aerospace, government, and critical infrastructure sectors.

Goals & Targeting

APT37's strategic objectives revolve around conducting cyber espionage targeting sectors such as healthcare, aerospace & defense, manufacturing, government, and critical infrastructure. The group focuses on countries with significant political or economic interests opposing North Korea, including South Korea, Japan, India, Russia, and Middle Eastern nations. Their campaigns often involve large-scale operations aimed at stealing sensitive information and disrupting the targeted organizations.

APT37, also known as InkySquid or TEMP.Reaper, is a North Korean state-sponsored cyber espionage group that has been operational since at least 2012. The group has conducted numerous campaigns between 2016-2018, including Operation Daybreak, Golden Time, and Evil New Year. APT37 primarily targets South Korea but has also targeted other countries such as Japan, India, Russia, Nepal, China, Romania, and Kuwait. Their main objective is to gather intelligence through cyber espionage activities.

Key Capabilities

• Advanced persistent threat (APT) tactics
• Malware development and deployment
• Spear-phishing attacks
• Data exfiltration techniques
• Process injection and persistence mechanisms

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

APT37 has been involved in multiple campaigns, including Operation Daybreak and Operation Erebus. These campaigns often involve large-scale spear-phishing attacks, the deployment of custom malware, and the targeting of critical infrastructure sectors. The group's operational tempo is consistent with other North Korean state-sponsored actors, with a focus on long-term espionage objectives.

IOC Patterns

• Spear-phishing emails with malicious attachments
• Malicious scripts embedded in Office documents
• Scheduled task creation for persistence
• Registry modifications for malware persistence

Recommended Actions

• Implement strong email filtering to detect spear-phishing attempts
• Monitor for unusual scheduled tasks and process injection activities
• Conduct regular vulnerability assessments on critical infrastructure systems
• Use endpoint detection and response (EDR) solutions to identify malicious processes
• Train employees on identifying phishing emails

Suggested Tags