APT37
Threat actorAttributed to North Korea by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT37Our name
- Ricochet ChollimaCrowdStrike
- ScarCruftKaspersky
- Group123Mandiant
- ReaperMandiant
- TEMP.ReaperMandiant
- InkySquidVolexity
Targets
Regions: Middle East, Japan, South Korea, India, Vietnam
Source: MITRE ATT&CKKnown techniques
- T1005Data from Local System
- T1027Obfuscated Files or Information
- T1027.003Steganography
- T1033System Owner/User Discovery
- T1036.001Invalid Code Signature
- T1053.005Scheduled Task
- T1055Process Injection
- T1057Process Discovery
- T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.005Visual Basic
- T1059.006Python
- T1071.001Web Protocols
- T1082System Information Discovery
- T1102.002Bidirectional Communication
- T1105Ingress Tool Transfer
- T1106Native API
- T1120Peripheral Device Discovery
- T1123Audio Capture
- T1189Drive-by Compromise
- T1203Exploitation for Client Execution
- T1204.002Malicious File
- T1529System Shutdown/Reboot
- T1547.001Registry Run Keys / Startup Folder
- T1548.002Bypass User Account Control
- T1555.003Credentials from Web Browsers
- T1559.002Dynamic Data Exchange
- T1561.002Disk Structure Wipe
- T1566.001Spearphishing Attachment
Malware and tools used
BLUELIGHTCobalt StrikeCORALDECKDOGCALLFinal1stspyHAPPYWORKKARAENavRATPOORAIMROKRATSHUTTERSPEEDSLOWDRIFTWINERACK
Source: MITRE ATT&CKRecent news
No stories yet.