- Category
- State · Attributed to a state or working for one.
- Origin
- North Korea(high confidence)
- Sponsor
- State-sponsored
- Agency named
- Lazarus, Ministry of State Security
- Motivation
- Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0067 · 29 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0057 · apt37
North KoreaWhat it is
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Ricochet Chollima, VELVET CHOLLIMA
- IBM X-Force
- ITG10
- Mandiant
- APT 37, TEMP.Reaper
- Microsoft
- Ruby Sleet, Opal Sleet
- MITRE ATT&CK
- G0067
- PwC
- Red Eyes
- Qihoo 360
- APT-C-28
- Talos and others
- Group 123, Group123
- Thales
- ATK4
- Operations
- Operation Daybreak, Operation Erebus, Operation “Are You Happy?”, Operation “Battle Cruiser”, Operation “Black Banner”, Operation “Daybreak”, Operation “Dragon messenger”, Operation “Erebus”, Operation “Evil New Year 2018”, Operation “Evil New Year”, Operation “Fractured Block”, Operation “Fractured Statue”, Operation “FreeMilk”, Operation “Golden Bird”, Operation “Golden Time”, Operation “High Expert”, Operation “Holiday Wiper”, Operation “Korean Sword”, Operation “North Korean Human Right”, Operation “Onezero”, Operation “Rocket Man”, Operation “SHROUDED#SLEEP”, Operation “Spy Cloud”, Operation “Star Cruiser”, Operation “STARK#MULE”, Operation “STIFF#BIZON”, Operation “ToyBox Story”
- Other names
- Reaper, ScarCruft, APT37（Reaper）, ATK 4, Cerium, Crooked Pisces, Geumseong121, Hermit, InkySquid, Moldy Pisces, Osmium, PLAIN NEPTUNE, Reaper Group, Reaper, APT 37, Ricochet Chollima, ScarCruft, ScarCruft - APT-C-28, TA-RedAnt, Venus 121
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTNorth Korea
- MISP Galaxy (CFR tagging)North Korea
- MicrosoftNorth Korea
- ThreatActor.info (Malpedia et al.)North Korea · high
Chinese and Russian sources
- Qihoo 360North Korea
Targets
- Countries
- Cambodia, China, Czech, Hong Kong, India, Japan, Kuwait, Laos, Nepal, Poland, Romania, Russia, South Korea, Thailand, United Kingdom, United States, Vietnam
- Sectors
- Aerospace, Automotive, Chemical, Education, Financial, Government, Healthcare, High-Tech, Manufacturing, Media, Private sector, Technology, Transportation
Tools
The tools and malware families the sources tie to it.
- BLUELIGHT
- CORALDECK
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- DOGCALL
- Final1stspy
- HAPPYWORK
- KARAE
- NavRAT
- POORAIM
- ROKRAT
- SHUTTERSPEED
- SLOWDRIFT
- SPACESHIP
- WINERACK
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net