North Korean state-sponsored hacking group APT37 delivered a previously undocumented backdoor and remote access trojan called VeilShell to targets in Cambodia in 2024

EuRepoC

North Korean state-sponsored hacking group APT37 compromised targets in Cambodia and potentially other Southeast Asian countries in a campaign dubbed SHROUDED#SLEEP, using a previously undocumented backdoor and remote access trojan (RAT) called VeilShell, as reported by Securonix on 3 October 2024. The group delivered the malware via spear-phishing emails, allowing the attacker full access to the compromised machine, including data exfiltration, registry, and scheduled task creation or manipulation. The attack chain featured a lesser-known technique called AppDomainManager injection and used a PowerShell-based malware to contact a command-and-control (C2) server to await further instructions. Securonix researchers Den Iuzvyk and Tim Peck disclosed the ongoing operation in a technical report on 3 October 2024.

ThaiCERT Threat Group Cards

Operation “SHROUDED#SLEEP” SHROUDED#SLEEP: A Deep Dive into North Korea’s Ongoing Campaign Against Southeast Asia https://www.securonix.com/blog/shroudedsleep-a-deep-dive-into-north-koreas-ongoing-campaign-against-southeast-asia/

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers at Securonix uncover SHROUDED#SLEEP, a campaign where threat actors with ties to North Korea deliver a previously undocumented backdoor and remote access trojan (RAT) called VeilShell as part of a campaign targeting Cambodia and likely other Southeast Asian countries. [Date Occurred: -; Date Discovered: -]

Based on the identified samples, it is evident that the target victimology is focused on Southeast Asia, specifically Cambodia.