APT37

Origin🇰🇵 Coreia do Norte

Techniques (MITRE ATT&CK)29

SourceMITRE ATT&CK

State sponsor: Korea (Democratic People's Republic of)Attribution confidence: 50%Target categories: Government, Private sector

Targeted regions: South Korea · Japan · Vietnam

Also known as:APT-C-28ATK4G0067Group 123Group123InkySquidMoldy PiscesOperation DaybreakOperation ErebusPLAIN NEPTUNEReaperReaper GroupRed EyesRicochet ChollimaScarCruftTEMP.ReaperVenus 121

About the group

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity63

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 29

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Initial access

Drive-by Compromise Spearphishing Attachment

Execution

Scheduled Task Command and Scripting Interpreter Windows Command Shell Visual Basic Python Native API Exploitation for Client Execution Malicious File Dynamic Data Exchange

Persistence

Registry Run Keys / Startup Folder

Privilege escalation

Bypass User Account Control

Credential access

Credentials from Web Browsers

Discovery

System Owner/User Discovery Process Discovery System Information Discovery Peripheral Device Discovery

Collection

Data from Local System Audio Capture

Command and control

Web Protocols Bidirectional Communication Ingress Tool Transfer

Impact

System Shutdown/Reboot Disk Structure Wipe

stealth

Obfuscated Files or Information Steganography Invalid Code Signature Process Injection

Exploited vulnerabilities 6

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-0199HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2016-4117HIGHEPSS 94%KEV MITRE ATT&CK

CVE-2018-4878HIGHEPSS 90%KEV MITRE ATT&CK

CVE-2021-26411HIGHEPSS 81%KEV MITRE ATT&CK

CVE-2020-1380HIGHEPSS 24%KEV MITRE ATT&CK

CVE-2020-26411MEDIUMEPSS 1% MITRE ATT&CK

References

APT37 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →