EuRepoC
APT37 uses M2RAT backdoor for intelligence collection purposes on unspecified individuals since 2023 · 01.01.2023
According to a report by AhnLab Security Emergency response Center (ASEC), APT37, which industry reporting has identified as a state-sponsored group with ties to North Korea, has used an M2RAT backdoor for intelligence collection purposes against unspecified individuals since 2023. The group circulated phishing messages containing an attachment designed to exploit a vulnerability in the Hangul word processor (CVE-2017-8291) widely in use in South Korea. The backdoor enables the attackers to conduct keylogging, data theft, remote command execution, and to take screenshots on compromised machines.