APT37
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Associated Group Descriptions
| Name | Description |
|---|---|
| InkySquid | |
| ScarCruft | |
| Reaper | |
| Group123 | |
| TEMP.Reaper | |
| Ricochet Chollima |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1555 | .003 | 从密码存储中获取凭证: Credentials from Web Browsers |
APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.[1] |
| Enterprise | T1005 | 从本地系统获取数据 | ||
| Enterprise | T1036 | .001 | 伪装: Invalid Code Signature |
APT37 has signed its malware with an invalid digital certificates listed as "Tencent Technology (Shenzhen) Company Limited."[2] |
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
APT37's has added persistence via the Registry key |
| Enterprise | T1059 | 命令与脚本解释器 | ||
| .003 | Windows Command Shell | |||
| .005 | Visual Basic |
APT37 executes shellcode and a VBA script to decode Base64 strings.[3] |
||
| .006 | Python | |||
| Enterprise | T1120 | 外围设备发现 |
APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. [5] |
|
| Enterprise | T1203 | 客户端执行漏洞利用 |
APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.[2][1][3][4] |
|
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols | |
| Enterprise | T1106 | 本机API |
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.[3] |
|
| Enterprise | T1189 | 浏览器攻击 |
APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.[2][1][4] |
|
| Enterprise | T1027 | 混淆文件或信息 | ||
| .003 | Steganography |
APT37 uses steganography to send images to users that are embedded with shellcode.[3][5] |
||
| Enterprise | T1548 | .002 | 滥用权限提升控制机制: Bypass User Account Control |
APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.[5] |
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
APT37 has sent spearphishing attachments attempting to get a user to open them.[1] |
| Enterprise | T1561 | .002 | 磁盘擦除: Disk Structure Wipe |
APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).[1][3] |
| Enterprise | T1082 | 系统信息发现 |
APT37 collects the computer name, the BIOS model, and execution path.[3] |
|
| Enterprise | T1529 | 系统关机/重启 |
APT37 has used malware that will issue the command |
|
| Enterprise | T1033 | 系统所有者/用户发现 | ||
| Enterprise | T1102 | .002 | 网络服务: Bidirectional Communication |
APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.[1][3] |
| Enterprise | T1105 | 输入工具传输 |
APT37 has downloaded second stage malware from compromised websites.[1][5][4][7] |
|
| Enterprise | T1057 | 进程发现 |
APT37's Freenki malware lists running processes using the Microsoft Windows API.[3] |
|
| Enterprise | T1055 | 进程注入 |
APT37 injects its malware variant, ROKRAT, into the cmd.exe process.[3] |
|
| Enterprise | T1559 | .002 | 进程间通信: Dynamic Data Exchange |
APT37 has used Windows DDE for execution of commands and a malicious VBS.[2] |
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
APT37 delivers malware using spearphishing emails with malicious HWP attachments.[1][3][5] |
| Enterprise | T1123 | 音频捕获 |
APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.[1] |
|
| Enterprise | T1053 | .005 | 预定任务/作业: Scheduled Task |
APT37 has created scheduled tasks to run malicious scripts on a compromised host.[7] |
Software
References
- FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
- Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.
- Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
- Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.
- GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.
- CrowdStrike. (2021, September 30). Adversary Profile - Ricochet Chollima. Retrieved September 30, 2021.
- Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.
- Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.
- Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.