Mandiant / Google Cloud Threat Intelligence blog
Suspected APT37 GitHub repository with decoy documents (exposed March 2023) · 2023-10-10 (datePublished)
In late March 2023, public reporting described the exposure of a suspected APT37 GitHub repository containing samples, files, and additional tooling. ... The decoy documents and files identified in the repository focused on a variety of themes, but appeared to be focused on organizations in the education, government, and financial sectors. Many of the victims and targets appear to be based in South Korea, based on the usage of HWP files and themes.