CVE Intelligence
Início / Grupos de ameaça / APT37

APT37 G0067

🔔 Criar alerta

Também conhecido como: InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

6
CVEs associadas
33
Técnicas
13
Malwares e ferramentas

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2021-26411 Alta · 8.8 KEV Ransomware Microsoft Internet Explorer Memory Corruption Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2020-26411 ainda não publicada aqui
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2020-1380 Alta · 7.8 KEV Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2018-4878 Alta · 7.8 KEV Ransomware Adobe Flash Player Use-After-Free Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2017-0199 Alta · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”
CVE-2016-4117 Crítica · 9.8 KEV Ransomware Adobe Flash Player Arbitrary Code Execution Vulnerability
“APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.”

Técnicas por tática

Acesso inicial
T1189 Drive-by CompromiseT1566.001 Spearphishing Attachment
Execução
T1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.006 PythonT1106 Native APIT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistência
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
Escalada de privilégios
T1053.005 Scheduled TaskT1055 Process InjectionT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control
Furtividade
T1027 Obfuscated Files or InformationT1027.003 SteganographyT1036.001 Invalid Code SignatureT1055 Process Injection
Acesso a credenciais
T1555.003 Credentials from Web Browsers
Descoberta
T1033 System Owner/User DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1120 Peripheral Device Discovery
Coleta
T1005 Data from Local SystemT1123 Audio Capture
Comando e controle
T1071.001 Web ProtocolsT1102.002 Bidirectional CommunicationT1105 Ingress Tool Transfer
Impacto
T1529 System Shutdown/RebootT1561.002 Disk Structure Wipe

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.