EuRepoC
ScarCruft Chinotto Surveillance · 22.03.2021
North korean state-sponsored hacking group ScarCruft hacked and stole sensitive data from journalists, north korean defector and human rights activists in South Korea.
ScarCruft surveilling North Korean defectors and human rights activists
- Date (as written)
- 2021-03
- Year
- 2021
- Actors (as written)
- Reaper, APT 37, Ricochet Chollima, ScarCruft
- Actor pages
- ReaperAPT 37Ricochet ChollimaScarCruft
Source entries (5)
ThaiCERT Threat Group Cards
ScarCruft surveilling North Korean defectors and human rights activists · 2021-03
ScarCruft surveilling North Korean defectors and human rights activists https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
Check Point Research
6th December – Threat Intelligence Report · 2021-12-06
North Korean cyberespionage group ScarCruft (APT 37) is targeting South Korean journalists, activists, or politically relevant individuals with spear-phishing emails and smishing campaigns deploying the Chinotto backdoor.
Hackmageddon cyber attacks timelines (Paolo Passeri)
South Korean journalists, defectors, and human rights activists · 29/11/2021
Researchers from Kaspersky reveal the details of the latest campaign of APT37 targeting South Korean journalists, defectors, and human rights activists with a new malware dubbed Chinotto. [Date Occurred: -; Date Discovered: -]
Kaspersky Securelist
ScarCruft surveilling North Korean defectors and human rights activists · 2021-11-29T10:00:31
The ScarCruft group (also known as APT37 or Temp.Reaper) is a nation-state sponsored APT actor. Recently, we had an opportunity to perform a deeper investigation on a host compromised by this group.
Values found later for empty fields
country: South Korea
Based on the IP addresses, we could distinguish four different suspected victims located in South Korea