DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

ScarCruft (65)

Events whose actors field, as written by the source, names this.

Date (as written)IncidentCountryActors
01.01.2012North Korea espionage campaignKorea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region)APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067
2012Spying on South Korean users.Reaper, APT 37, Ricochet Chollima, ScarCruft
01.01.2014Reaper/APT37 vs. South Korean TargetsKorea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic ofAPT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067;Group123
2016Operation “Erebus”Reaper, APT 37, Ricochet Chollima, ScarCruft
2016-03Operation “Daybreak”Reaper, APT 37, Ricochet Chollima, ScarCruft
2016-08Operation “Golden Time”Reaper, APT 37, Ricochet Chollima, ScarCruft
2016-11Operation “Evil New Year”Reaper, APT 37, Ricochet Chollima, ScarCruft
01.01.2017Reaper vs. Japan/Vietnam/Middle EastVietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region)APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067;Group123
2017-03Operation “Are You Happy?”Reaper, APT 37, Ricochet Chollima, ScarCruft
2017-05Operation “FreeMilk”Reaper, APT 37, Ricochet Chollima, ScarCruft
2017-11Operation “North Korean Human Right”Reaper, APT 37, Ricochet Chollima, ScarCruft
2017-12Operation “Fractured Block”Reaper, APT 37, Ricochet Chollima, ScarCruft
01.01.2018NavRATKorea, Republic ofAPT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067
2018-01Operation “Evil New Year 2018”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-03Operation “Battle Cruiser”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-04Operation “Star Cruiser”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-05Operation “Onezero”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-08Operation “Rocket Man”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-11Operation “Korean Sword”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-01Operation “Holiday Wiper”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-03Operation “Golden Bird”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-03Operation “High Expert”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-04Operation “Black Banner”Reaper, APT 37, Ricochet Chollima, ScarCruft
2019-09Operation “Dragon messenger”Reaper, APT 37, Ricochet Chollima, ScarCruft
2020-03Operation “Spy Cloud”Reaper, APT 37, Ricochet Chollima, ScarCruft
2021-03ScarCruft surveilling North Korean defectors and human rights activistsReaper, APT 37, Ricochet Chollima, ScarCruft
01.01.2021North Korean defector Kang Mi-JinKorea, Democratic People's Republic of;Korea, Democratic People's Republic ofAPT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067
2021-04North Korean APT InkySquid Infects Victims Using Browser ExploitsReaper, APT 37, Ricochet Chollima, ScarCruft
01.07.2022North Korean state-sponsored hacker group ScarCruft used RokRAT malware against unspecified Korean-speaking individuals beginning in July 2022Not availableAPT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067
2022-07Operation “STIFF#BIZON”Reaper, APT 37, Ricochet Chollima, ScarCruft
2022-09Meeting the “Ministrer”Reaper, APT 37, Ricochet Chollima, ScarCruft
2022-10Internet Explorer 0-day exploited by North Korean actor APT37Reaper, APT 37, Ricochet Chollima, ScarCruft
01.01.2023APT37 uses M2RAT backdoor for intelligence collection purposes on unspecified individuals since 2023Not availableAPT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067
2023-04ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)Reaper, APT 37, Ricochet Chollima, ScarCruft
2023-07Operation “STARK#MULE”Reaper, APT 37, Ricochet Chollima, ScarCruft
2023-12ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity ProfessionalsReaper, APT 37, Ricochet Chollima, ScarCruft
07/08/2023NPO MashinostroyeniyaRUScarCruft
2023-02-14스테가노그래피 기법 사용한 한글(HWP) 악성코드 : RedEyes(ScarCruft)APT37; RedEyes; ScarCruft
2023-09-19'금성121' APT 조직, 국내 정치사회적 이슈를 악용한 공격 진행중!APT37; Geumseong121; ScarCruft; 금성121
2023-03-03국내 금융 기업 보안 메일을 사칭한 CHM 악성코드 : RedEyes(ScarCruft)APT37; RedEyes; ScarCruft
2023-03-10패스워드 파일로 위장하여 유포 중인 악성코드RedEyes; ScarCruft
2023-03-23Kimsuky 그룹, 약력 양식 파일로 위장한 악성코드 유포 (GitHub)APT37; Kimsuky; ScarCruft
2023-04-21링크 파일(*.lnk)을 통해 유포되는 RokRAT 악성코드 : RedEyes(ScarCruft)APT37; RedEyes; ScarCruft
2023-04-28EDR 제품을 통한 RokRAT 유포 링크 파일(*.lnk) 추적 및 대응APT37; RedEyes; ScarCruft
2023-06-09Threat Trend Report on APT Groups – April 2023APT37; Kimsuky; Lazarus; ScarCruft
2023-07-07Threat Trend Report on APT Groups – May 2023APT37; Andariel; Kimsuky; Lazarus; ScarCruft
2023-07-20국내 금융 기업 및 보험사를 사칭한 CHM 악성코드APT37; RedEyes; ScarCruft
2023-09-01Backdoor를 유포하는 악성 LNK : RedEyes(ScarCruft)APT37; RedEyes; ScarCruft
2023-09-04후쿠시마 오염수 방류 내용을 이용한 CHM 악성코드 : RedEyes(ScarCruft)RedEyes; ScarCruft
2023-04-11APT-C-28（ScarCruft）组织对韩国地区攻击活动分析APT-C-28; ScarCruft; Konni
2023-07-14APT-C-28（ScarCruft）组织针对能源方向投放Rokrat后门活动分析APT37; APT-C-28; ScarCruft; Reaper
2023-06-22북한의 스카크러프트, 새로운 멀웨어 사용해 탈북자 염탐APT37; ScarCruft; 스카크러프트; Reaper
14 September 2023“Konni APT exploits WinRAR vulnerability (CVE-2023-38831) targeting the cryptocurrency industry,” Chuangyu 404 Advanced Threat Intelligence TeamScarCruft (APT 37)
2024-09Kimsuky-linked hackers use similar tactics to attack Russia and South Korea, researchers sayReaper, APT 37, Ricochet Chollima, ScarCruft
2024-04-23RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장)RedEyes; ScarCruft
2024-03-04APT37利用朝鲜政治话题针对韩国的攻击活动分析APT37; ScarCruft; Reaper
2024-02-06T00:00:00.000ZAPT37 / ScarCruft profile (in "Beyond Headlines & Borders: An Overview of Advanced Threats")South Korea; Japan; Russia; China; the Middle EastAPT37; Ricochet Chollima; RubySleet; InkySquid; ScarCruft
2025-03Operation “ToyBox Story”Reaper, APT 37, Ricochet Chollima, ScarCruft
2025-08-07ScarCruft’s New Language: Whispering in PubNub, Crafting Backdoor in Rust, Striking with RansomwareChinopuNK; ScarCruft
2025-09-02북한 APT37, 한국 정부·정보기관 대상 정교한 스피어피싱 공격 전개APT37; ScarCruft; Reaper
Not availableNorth Korean State-Sponsored Hacking Group APT37 Stole Advertising Content From a South Korean Ad Agency to Target End Users in 2024Korea, Republic of;Korea, Republic ofAPT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067
Septemberthreat_inteligence_report_k onniapt.pdfScarCruft
Septemberhttps://paper.seebug.org/3033/ScarCruft
Novemberkonni-campaign-distributed-via-malicious-documentScarCruft
WinRAR vulnerability (CVE-2023-38831) attack on the cryptocurrency industryScarCruft