Log in Request a demo

Threat group profile

APT37

Also known as ScarCruft, InkySquid

MITRE ATT&CK describes APT37, also called ScarCruft, as a North Korean state-sponsored cyber espionage group that has been active since at least 2012.

In short

MITRE ATT&CK describes APT37, also called ScarCruft, as a North Korean state-sponsored cyber espionage group that has been active since at least 2012. It targets South Korea first, using spearphishing emails with Hangul (HWP) attachments, compromised websites and cloud services for control. No government advisory opened names the group itself.

Last updated 10 October 2026

Profile MapThreat Group
  1. Attributed OriginNorth Korea
  2. Names7names in public reportsAPT37 · ScarCruft · InkySquid
  3. Sectors5named as targetsSouth Korea · Not stated
  4. Techniques14in the attack chainInitial Access · Execution · Persistence
  5. Tools9tools and malware listedROKRAT · BLUELIGHT · NavRAT

In one minute

Who they are
MITRE ATT&CK describes APT37 as a North Korean state-sponsored cyber espionage group, active since at least 2012. No government advisory opened names the group itself, so this profile rests on MITRE and on one CERT-EU brief.
Who they target
MITRE says victims are primarily in South Korea, and also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait and other parts of the Middle East. A January 2024 campaign hit South Korean academics and a news organization, as recorded by CERT-EU.
How they usually get in
MITRE lists spearphishing emails with malicious Hangul Word Processor (HWP) attachments, compromised South Korean websites and torrent sites, and exploits for Flash Player, Word, Internet Explorer and Edge flaws.
What stands out
MITRE says the group uses social networking and cloud services (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox and Box) for command and control, and that it has a Bluetooth device harvester and malware able to overwrite the master boot record.
What to do first
Block unexpected attachments, patch browsers and Office, and restrict which cloud and social sites systems may contact, as MITRE advises for these techniques.

Names

Public reports use several names for this activity.

Names used for APT37
NameWhere it appears
APT37 Main name on the MITRE ATT&CK group page G0067[1]
ScarCruft MITRE ATT&CK Associated Groups; CERT-EU Cyber Security Brief 24-02 (January 2024)[1, 7]
InkySquid MITRE ATT&CK Associated Groups[1]
Reaper MITRE ATT&CK Associated Groups[1]
Group123 MITRE ATT&CK Associated Groups[1]
TEMP.Reaper MITRE ATT&CK Associated Groups[1]
Ricochet Chollima MITRE ATT&CK Associated Groups[1]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Describes APT37 as a North Korean state-sponsored cyber espionage group that has been active since at least 2012.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Says the group has targeted victims primarily in South Korea, and also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait and other parts of the Middle East.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Links APT37 to eight campaigns between 2016 and 2018, including Operation Daybreak, Operation Erebus and Golden Time.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Warns that North Korean group definitions overlap and that some researchers report all North Korean state-sponsored activity under the name Lazarus Group.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Lists six associated names: InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper and Ricochet Chollima.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Says APT37 used the ROKRAT remote access tool in several campaigns from 2016 through 2021.[2]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Says APT37 used the DOGCALL backdoor to target South Korean government and military organizations in 2017.[5]

  • CERT-EU 2 February 2024

    Its Cyber Security Brief of January 2024 calls ScarCruft (aka APT37) a group "believed to be linked to North Korea" and relays a researchers' report of a campaign against South Korean academics and a news organization.[7]

Where sources differ

No government advisory, indictment or sanction opened names APT37 or ScarCruft. MITRE ATT&CK states the North Korean link as fact. CERT-EU words it as "believed to be linked to North Korea" and repeats a researchers' report instead of making its own attribution. MITRE also notes that North Korean group definitions overlap and that some researchers use the name Lazarus Group for all of them, so the line between APT37 and other North Korean groups is not settled.

Who they target

Sectors

  • South KoreaMITRE says the DOGCALL backdoor was used against South Korean government and military organizations in 2017.[5]
  • South KoreaCERT-EU records a January 2024 campaign against academics focused on North Korean affairs.[7]
  • South KoreaCERT-EU records the same campaign against a North Korea-focused news organization.[7]
  • Not statedCERT-EU says a research-report decoy was tested and may also have targeted cybersecurity professionals.[7]
  • South KoreaMITRE says the group compromised South Korean websites and used torrent file-sharing sites to spread malware widely.[1]

Regions

  • South KoreaMITRE says victims are primarily in South Korea.[1]
  • Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait and the wider Middle EastMITRE lists these as other places where victims were found.[1]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. At least 2012

    Earliest activity

    MITRE says APT37 has been active since at least 2012.[1]

  2. 2016 to 2018

    Eight named campaigns

    MITRE links the group to Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights and Evil New Year 2018.[1]

  3. 2016 to 2021

    ROKRAT in use

    MITRE says APT37 used ROKRAT in several campaigns in this period.[2]

  4. 2017

    DOGCALL against South Korea

    MITRE says the backdoor was used to target South Korean government and military organizations.[5]

  5. Early 2021

    BLUELIGHT first seen

    MITRE says the BLUELIGHT remote access trojan was first observed in early 2021.[3]

  6. 22 January 2024

    Campaign against academics and media

    CERT-EU records that researchers disclosed a ScarCruft campaign on this date against South Korean academics and a news organization.[7]

  7. 31 July 2026

    MITRE profile updated

    The MITRE ATT&CK page for APT37 was last modified on this date (version 2.0).[1]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about APT37
DateWhoWhat
2 February 2024 CERT-EU Threat intelligence briefCyber Security Brief 24-02 includes a paragraph on a ScarCruft (aka APT37) campaign against South Korean academics and a news organization. It repeats a researchers' report and gives no mitigations for it.[7]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    MITRE says it delivers malware by spearphishing emails with malicious HWP attachments.[1]

  • Drive-by Compromise T1189

    MITRE says it compromised websites, particularly South Korean ones, and used torrent sites; a JavaScript profiler called RICECURRY fits the payload to the browser.[1]

Execution

  • Exploitation for Client Execution T1203

    MITRE lists exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380, CVE-2021-26411).[1]

  • User Execution: Malicious File T1204.002

    MITRE says it sends spearphishing attachments that the user has to open.[1]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    MITRE says it adds persistence through the Registry Run key.[1]

Privilege Escalation

  • Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002

    MITRE says the first dropper contains a function to bypass Windows UAC before running the next payload.[1]

Credential Access

  • Credentials from Password Stores: Credentials from Web Browsers T1555.003

    MITRE says the ZUMKONG stealer harvests usernames and passwords stored in browsers.[1]

Discovery

  • Peripheral Device Discovery T1120

    MITRE says it has a Bluetooth device harvester that uses Windows Bluetooth APIs.[1]

Collection

  • Audio Capture T1123

    MITRE says the SOUNDWAVE utility captures microphone input.[1]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    MITRE says it uses HTTPS to conceal command and control traffic.[1]

  • Web Service: Bidirectional Communication T1102.002

    MITRE says it uses social networking sites and cloud platforms for command and control.[1]

Impact

  • Disk Wipe: Disk Structure Wipe T1561.002

    MITRE says it has destructive malware able to overwrite the master boot record.[1]

Stealth

  • Obfuscated Files or Information: Steganography T1027.003

    MITRE says it sends images with shellcode embedded in them.[1]

  • Process Injection T1055

    MITRE says it injects ROKRAT into the cmd.exe process.[1]

Tools and malware

  • ROKRAT Cloud-based remote access tool

    MITRE says APT37 used it to target victims in South Korea in several campaigns from 2016 through 2021.[2]

  • BLUELIGHT Remote access trojan

    MITRE says it was first observed in early 2021.[3]

  • NavRAT Remote access tool

    MITRE says it uploads, downloads and executes files and has been seen in attacks on South Korea.[4]

  • DOGCALL Backdoor

    MITRE says it targeted South Korean government and military organizations in 2017 and is typically dropped with an HWP exploit.[5]

  • CORALDECK Exfiltration tool

    MITRE says it creates password-protected archives and sends data in HTTP POST headers.[6]

  • Cobalt Strike Commercial attack framework

    MITRE lists it among the software APT37 has used.[1]

  • SOUNDWAVE Audio capture utility

    MITRE says it captures microphone input.[1]

  • ZUMKONG Credential stealer

    MITRE says it harvests usernames and passwords saved in browsers.[1]

  • RICECURRY JavaScript profiler

    MITRE says it profiles a victim's browser during web compromises so the right malicious code is delivered.[1]

Detection and defense

  1. Block unknown attachments

    MITRE advises blocking unknown or unused attachment types by default and scanning inbound mail attachments.

    Counters T1566.001

  2. Patch browsers and Office

    Keep browsers, plugins and Office up to date, as MITRE advises against client exploitation. The group is listed with Flash, Word, Internet Explorer and Edge flaws.

    Counters T1203 T1189

  3. Add exploit protection

    MITRE names browser sandboxes and exploit protection tools as ways to limit what a client-side exploit can do.

    Counters T1203 T1189

  4. Restrict web content

    MITRE suggests script blocking and ad blocking to stop malicious code served by compromised sites.

    Counters T1189

  5. Control cloud and social services

    MITRE advises web proxies that enforce a policy on which external services systems may use, plus network signatures for known malware.

    Counters T1102.002

  6. Use application control

    MITRE advises application control and attack surface reduction rules to stop files that pose as other types from running.

    Counters T1204.002

  7. Train staff

    MITRE advises user training on spearphishing and on suspicious files.

    Counters T1204.002 T1566.001

What Brandefense can do

Questions

Who is APT37?

MITRE ATT&CK describes APT37 as a North Korean state-sponsored cyber espionage group active since at least 2012. It is also listed as ScarCruft, InkySquid, Reaper, Group123, TEMP.Reaper and Ricochet Chollima. No government advisory opened names the group.

What does APT37 target?

MITRE says victims are primarily in South Korea, and also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait and other parts of the Middle East. CERT-EU records a January 2024 campaign against South Korean academics and a news organization.

How does APT37 get in?

MITRE lists spearphishing emails with malicious HWP attachments, compromised websites and torrent sites, and exploits for Flash Player, Word, Internet Explorer and Edge flaws.

What malware does APT37 use?

MITRE lists ROKRAT, BLUELIGHT, NavRAT, DOGCALL and CORALDECK, among others, plus Cobalt Strike. ROKRAT is described as a cloud-based remote access tool.

Is APT37 the same as ScarCruft?

Yes as far as MITRE ATT&CK is concerned: ScarCruft is listed as an associated name for APT37, and CERT-EU writes "ScarCruft (aka APT37)".

What should a company do first?

Block unexpected attachments, patch browsers and Office, and limit which cloud and social sites systems can reach, as MITRE advises for these techniques.

In our research

  1. APT37: North Korea’s Active Cyberespionage Group November 2025
  2. The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
  3. RokRAT Technical Analysis July 2025
  4. [Research Summary]: RokRat June 2024

Sources

  1. APT37, InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima, Group G0067 MITRE ATT&CK Supports: Names, description, campaigns, techniques, software, version and dates
  2. ROKRAT, Software S0240 MITRE ATT&CK Supports: ROKRAT description and 2016 to 2021 use
  3. BLUELIGHT, Software S0657 MITRE ATT&CK Supports: BLUELIGHT description, first seen early 2021
  4. NavRAT, Software S0247 MITRE ATT&CK Supports: NavRAT description
  5. DOGCALL, Software S0213 MITRE ATT&CK Supports: DOGCALL description, 2017 use
  6. CORALDECK, Software S0212 MITRE ATT&CK Supports: CORALDECK description
  7. CERT-EU Cyber Security Brief 24-02, January 2024 CERT-EU Supports: ScarCruft (aka APT37) campaign of 22 January 2024
  8. Phishing: Spearphishing Attachment, Sub-technique T1566.001 MITRE ATT&CK Supports: Technique name and mitigations

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Threat group

Lazarus Group

Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units. They say these units work for the Reconnaissance General Bureau. The US charged three RGB members in 2020 and 2021 with attempts to steal or extort more than $1.3 billion. The FBI attributed the 2025 Bybit theft to North Korean actors it tracks as TraderTraitor.

Read more

Glossary term

Cyber espionage

Cyber espionage is the use of computer networks to secretly gather information that someone wants to keep private.

Read more

Malware

ROKRAT

ROKRAT is a cloud-based remote access tool for Windows.

Read more