APT37 (70)
Events whose actors field, as written by the source, names this.
| Date (as written) | Incident | Country | Actors |
|---|---|---|---|
| 01.01.2012 | North Korea espionage campaign | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region) | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 01.01.2014 | Reaper/APT37 vs. South Korean Targets | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067;Group123 |
| 01.01.2017 | Reaper vs. Japan/Vietnam/Middle East | Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region) | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067;Group123 |
| 01.01.2018 | NavRAT | Korea, Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 2018-02-20 (datePublished) | APT37 (Reaper) operations incl. zero-days and wiper malware | Primarily South Korea – though also Japan, Vietnam and the Middle East | APT37 (Reaper; Scarcruft; Group123) |
| 2020-03-25 | APT37 复盘分析报告（part1）：投递与执行 | Lazarus; APT37; Reaper | |
| 2020-05-15T00:00:43+00:00 | State-sponsored hacker groups join forces to capitalize on COVID-19 pandemic | Lazarus Group (APT38, Hidden Cobra); APT37 (Reaper) | |
| 2021-08-19T17:00:00+00:00 | New variant of Konni malware used in campaign targeting Russia | Russia | APT37 (Konni, potentially linked) |
| 01.01.2021 | North Korean defector Kang Mi-Jin | Korea, Democratic People's Republic of;Korea, Democratic People's Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 2021-01-05T17:00:00+00:00 | Retrohunting APT37: VBA self decode technique to inject RokRat | APT37 | |
| 2021-07-13 | Matryoshka : Variant of ROKRAT, APT37 (Scarcruft) | APT37; Scarcruft | |
| 01.07.2022 | North Korean state-sponsored hacker group ScarCruft used RokRAT malware against unspecified Korean-speaking individuals beginning in July 2022 | Not available | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 21/06/2023 | Multiple organizations | N/A | APT37 (AKA StarCruft, Reaper, or RedEyes) |
| 01.01.2023 | APT37 uses M2RAT backdoor for intelligence collection purposes on unspecified individuals since 2023 | Not available | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 2023-02-14 | 스테가노그래피 기법 사용한 한글(HWP) 악성코드 : RedEyes(ScarCruft) | APT37; RedEyes; ScarCruft | |
| 2023-09-19 | '금성121' APT 조직, 국내 정치사회적 이슈를 악용한 공격 진행중! | APT37; Geumseong121; ScarCruft; 금성121 | |
| 2023-03-03 | 국내 금융 기업 보안 메일을 사칭한 CHM 악성코드 : RedEyes(ScarCruft) | APT37; RedEyes; ScarCruft | |
| 2023-03-23 | Kimsuky 그룹, 약력 양식 파일로 위장한 악성코드 유포 (GitHub) | APT37; Kimsuky; ScarCruft | |
| 2023-04-21 | 링크 파일(*.lnk)을 통해 유포되는 RokRAT 악성코드 : RedEyes(ScarCruft) | APT37; RedEyes; ScarCruft | |
| 2023-04-28 | EDR 제품을 통한 RokRAT 유포 링크 파일(*.lnk) 추적 및 대응 | APT37; RedEyes; ScarCruft | |
| 2023-05-25 | 한컴 오피스 문서파일로 위장하여 유포중인 악성코드 증적 추적(RedEyes) | APT37; RedEyes | |
| 2023-06-09 | Damages to Multiple Korean Websites Created by a Certain Website Development Company | APT37; RedEyes | |
| 2023-06-09 | Threat Trend Report on APT Groups – April 2023 | APT37; Kimsuky; Lazarus; ScarCruft | |
| 2023-07-07 | Threat Trend Report on APT Groups – May 2023 | APT37; Andariel; Kimsuky; Lazarus; ScarCruft | |
| 2023-07-20 | 국내 금융 기업 및 보험사를 사칭한 CHM 악성코드 | APT37; RedEyes; ScarCruft | |
| 2023-08-16 | Threat Trend Report on APT Groups – June 2023 | APT37; Andariel; Kimsuky; Lazarus | |
| 2023-09-01 | Backdoor를 유포하는 악성 LNK : RedEyes(ScarCruft) | APT37; RedEyes; ScarCruft | |
| 2023-10-23 | 2023 Aug – Threat Trend Report on APT Groups | APT37; Andariel; Kimsuky; Lazarus | |
| 2023-11-13 | 2023 Sep – Threat Trend Report on APT Groups | APT37; Andariel; KONNI; Kimsuky; Konni; Lazarus | |
| 2023-06-20 | 한국내 macOS 이용자를 노린 APT37 공격 등장 | APT37; 북한연계 | |
| 2023-05-23 | 북한인권단체를 사칭한 APT37 공격 사례 | APT37; RedEyes; 북한 연계 | |
| 2023-09-01 | 한국 내 대북분야 종사자를 겨냥한 고도화된 BitB 공격 등장 | APT37; 북한 연계 | |
| 2023-10-16 | Operation DarkHorse CHM 기반 공격 분석 | APT37; Kimsuky | |
| 2023-11-30 | HWP 문서 내부에 악성 OLE 삽입 공격 FlowerPower APT 캠페인 Github C2 사용 | APT37; Kimsuky | |
| 2023-07-31 | 국세청 우편물 발송 알림 사칭 공격 (Konni APT Campaign) | APT37; KONNI; Konni; 북한 연계; 코니 | |
| 2023-12-29 | 북한 시장 물가 분석 문서 등으로 위장된 공격 사례 | APT37; Kimsuky | |
| 2023-07-14 | APT-C-28（ScarCruft）组织针对能源方向投放Rokrat后门活动分析 | APT37; APT-C-28; ScarCruft; Reaper | |
| 2023-06-22 | 북한의 스카크러프트, 새로운 멀웨어 사용해 탈북자 염탐 | APT37; ScarCruft; 스카크러프트; Reaper | |
| 2023-10-10 (datePublished) | Suspected APT37 GitHub repository with decoy documents (exposed March 2023) | South Korea | APT37 |
| CTA-NK-2023-0622 (report ID; June 2023) | North Korea's Cyber Strategy: 273 cyberattacks attributed to DPRK state-sponsored actors (July 2009 to May 2023) | South Korea; the US | Kimsuky; Lazarus Group; APT37 |
| 01.01.2024 | North Korean state-sponsored hacking group APT37 delivered a previously undocumented backdoor and remote access trojan called VeilShell to targets in Cambodia in 2024 | Cambodia | APT37 |
| May 2024 | “Operation Code on Toast”: IE zero-day via pop-up “toast ads” against ROK national security officials and DPRK-related NGOs (RokRAT) | Republic of Korea | APT37 |
| 2024-01-26 | WinRAR 취약점(CVE-2023-38831) 분석 보고서 | APT37; KONNI; Konni; 코니 | |
| 2024-11-05 | APT37 위협 배후의 사이버 정찰 활동 분석 | APT37; 북한 연계 | |
| 2024-03-27 | APT37 그룹의 RoKRAT 파일리스 공격 증가 | APT37; KONNI; Kimsuky; Konni; Lazarus; 김수키; 라자루스; 코니 | |
| 2024-01-16 | 2024년 Webinar 안내장 사칭 APT 공격 포착 | APT37 | |
| 2024-03-04 | APT37利用朝鲜政治话题针对韩国的攻击活动分析 | APT37; ScarCruft; Reaper | |
| 2024-05-24 | 瑞星EDR还原APT37组织对中韩食品行业攻击过程-AI云资讯 | APT37; Konni; Reaper | |
| 2024-02-06T00:00:00.000Z | APT37 / ScarCruft profile (in "Beyond Headlines & Borders: An Overview of Advanced Threats") | South Korea; Japan; Russia; China; the Middle East | APT37; Ricochet Chollima; RubySleet; InkySquid; ScarCruft |
| 2025-02-03 | K 메신저로 유포된 'APT37' 그룹의 악성 HWP 사례 분석 | APT37 | |
| 2025-06-12 | 2025년 5월 APT 그룹 동향 보고서 | APT37; KONNI; Konni; TA-RedAnt | |
| 2025-10-21 | 2025년 9월 APT 그룹 동향 보고서 | APT37; Kimsuky; Lazarus; TA-RedAnt | |
| 2025-11-09 | 국가 배후 위협 조직의 안드로이드 디바이스 대상 원격 초기화 전술 | APT37; KONNI; Kimsuky; Konni; 김수키; 코니 | |
| 2025-03-04 | 비상계엄 테마 APT 공격과 Kimsuky 그룹 연관성 분석 | APT37; Kimsuky; 김수키 | |
| 2025-12-21 | 작전명 아르테미스: HWP 기반 DLL 사이드 로딩 공격 분석 | APT37 | |
| 2025-08-03 | RoKRAT 셸코드 및 스테가노그래피 기반 위협 분석과 EDR 대응 방안 | APT37 | |
| 2025-09-02 | 북한 APT37, 한국 정부·정보기관 대상 정교한 스피어피싱 공격 전개 | APT37; ScarCruft; Reaper | |
| 2026-04-12 | APT37의 프리텍스팅 기반 표적 침투: 페이스북 정찰과 소프트웨어 변조 공격 분석 | APT37 | |
| 2026-05-05 | Korean-speaking users via sqgame[.]net (China-based game platform) | KR,CN | APT37 (a.k.a. ScarCruft, Ricochet Chollima) |
| 2026-06-14 | MS 사칭 피싱과 Dead-drop C2 기반 APT37 NarwhalRAT 분석 | APT37 | |
| 04/09/2026 | Two South Korean organizations (automotive and media sectors) | KR | APT37 (North Korea; medium confidence) |
| 2026-03-12 | 2026년 2월 APT 그룹 동향 보고서 | APT37; BlueNoroff; Lazarus; TA-RedAnt; 라자루스 | |
| 2026-07-14 | 2026년 6월 APT 그룹 동향 보고서 | APT37; APT38; Kimsuky; Lazarus; TA-RedAnt | |
| 2026-05-10 | AI 딥페이크 사칭 캠페인 후속 Python 백도어 위협 분석 | APT37 | |
| 2026-07-12 | Operation Capsule Vault: EMBED_PAYLOAD_v2 기반 RokRAT 공격 체인 분석 | APT37 | |
| 2026-01-18 | 포세이돈 작전: 구글 광고 리다이렉션 메커니즘을 악용한 스피어 피싱 공격 | APT37; KONNI; Kimsuky; Konni; 코니 | |
| Not available | North Korean State-Sponsored Hacking Group APT37 Stole Advertising Content From a South Korean Ad Agency to Target End Users in 2024 | Korea, Republic of;Korea, Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| (no date on page) | APT37 Facebook-based pretexting campaign with tampered PDFelement installer (in H1 2026 Malware Vulnerability Trends) | APT37 | |
| (no date on page) | From North Korean Phishing to Underground Online Hosting Services (Konni campaigns) | Bulgaria (hosting IP range) | APT37 (suspected); Konni |
| (no date on page) | Analysis of Konni RAT: Stealth, Persistence, and Anti-Analysis Techniques | Russia; East Asia; Europe; Middle East | APT37 (Konni) |