CVE Intelligence
Home / Threat actors / APT37

APT37 G0067

🔔 Create alert

Also known as: InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

6
associated CVEs
33
Techniques
13
Malware and tools

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-26411 High · 8.8 KEV Ransomware Microsoft Internet Explorer Memory Corruption Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2020-26411 not published here yet
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2020-1380 High · 7.8 KEV Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2018-4878 High · 7.8 KEV Ransomware Adobe Flash Player Use-After-Free Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2017-0199 High · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2016-4117 Critical · 9.8 KEV Ransomware Adobe Flash Player Arbitrary Code Execution Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”

Techniques by tactic

Initial Access
T1189 Drive-by CompromiseT1566.001 Spearphishing Attachment
Execution
T1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.006 PythonT1106 Native APIT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistence
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1055 Process InjectionT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control
Stealth
T1027 Obfuscated Files or InformationT1027.003 SteganographyT1036.001 Invalid Code SignatureT1055 Process Injection
Credential Access
T1555.003 Credentials from Web Browsers
Discovery
T1033 System Owner/User DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1120 Peripheral Device Discovery
Collection
T1005 Data from Local SystemT1123 Audio Capture
Command and Control
T1071.001 Web ProtocolsT1102.002 Bidirectional CommunicationT1105 Ingress Tool Transfer
Impact
T1529 System Shutdown/RebootT1561.002 Disk Structure Wipe

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.