DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

APT 37 (34)

Events whose actors field, as written by the source, names this.

Date (as written)IncidentCountryActors
2012Spying on South Korean users.Reaper, APT 37, Ricochet Chollima, ScarCruft
2016Operation “Erebus”Reaper, APT 37, Ricochet Chollima, ScarCruft
2016-03Operation “Daybreak”Reaper, APT 37, Ricochet Chollima, ScarCruft
2016-08Operation “Golden Time”Reaper, APT 37, Ricochet Chollima, ScarCruft
2016-11Operation “Evil New Year”Reaper, APT 37, Ricochet Chollima, ScarCruft
2017-03Operation “Are You Happy?”Reaper, APT 37, Ricochet Chollima, ScarCruft
2017-05Operation “FreeMilk”Reaper, APT 37, Ricochet Chollima, ScarCruft
2017-11Operation “North Korean Human Right”Reaper, APT 37, Ricochet Chollima, ScarCruft
2017-12Operation “Fractured Block”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-01Operation “Evil New Year 2018”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-03Operation “Battle Cruiser”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-04Operation “Star Cruiser”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-05Operation “Onezero”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-08Operation “Rocket Man”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-11Operation “Korean Sword”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-01Operation “Holiday Wiper”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-03Operation “Golden Bird”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-03Operation “High Expert”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-04Operation “Black Banner”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-09Operation “Dragon messenger”Reaper, APT 37, Ricochet Chollima, ScarCruft
2020-03Operation “Spy Cloud”Reaper, APT 37, Ricochet Chollima, ScarCruft
2021-03ScarCruft surveilling North Korean defectors and human rights activistsReaper, APT 37, Ricochet Chollima, ScarCruft
2021-04North Korean APT InkySquid Infects Victims Using Browser ExploitsReaper, APT 37, Ricochet Chollima, ScarCruft
August 2023CSIS entry 201
2022-07Operation “STIFF#BIZON”Reaper, APT 37, Ricochet Chollima, ScarCruft
2022-09Meeting the “Ministrer”Reaper, APT 37, Ricochet Chollima, ScarCruft
2022-10Internet Explorer 0-day exploited by North Korean actor APT37Reaper, APT 37, Ricochet Chollima, ScarCruft
Jul 2022Targeting of European Union (EU) member statesCzech Republic, Poland, and other EU countriesAPT 37
Apr 2022Targeting of journalists reporting on North KoreaJournalists and the former director of South Korea’s National Intelligence ServiceAPT 37
2023-04ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)Reaper, APT 37, Ricochet Chollima, ScarCruft
2023-07Operation “STARK#MULE”Reaper, APT 37, Ricochet Chollima, ScarCruft
2023-12ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity ProfessionalsReaper, APT 37, Ricochet Chollima, ScarCruft
2024-09Kimsuky-linked hackers use similar tactics to attack Russia and South Korea, researchers sayReaper, APT 37, Ricochet Chollima, ScarCruft
2025-03Operation “ToyBox Story”Reaper, APT 37, Ricochet Chollima, ScarCruft