APT37

APT37 is a suspected North Korean cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, Northern Korean Human Rights, and Evil New Year 2018. [1] [2] [3]

North Korean group definitions are known to have significant overlap, and the name Lazarus Group is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea.[4] Some organizations track North Korean clusters or groups such as Bluenoroff,[5] APT37, and APT38 separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.

ID: G0067
Associated Groups: ScarCruft, Reaper, Group123, TEMP.Reaper
Contributors: Valerii Marchuk, Cybersecurity Help s.r.o.
Version: 1.5
Created: 18 April 2018
Last Modified: 21 October 2020

Associated Group Descriptions

Name Description
ScarCruft

[2] [1][6]

Reaper

[1]

Group123

[1]

TEMP.Reaper

[1]

Techniques Used

Domain ID Name Use
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control

APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.[6]

Enterprise T1071 .001 Application Layer Protocol: Web Protocols

APT37 uses HTTPS to conceal C2 communications.[3]

Enterprise T1123 Audio Capture

APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.[1]

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.[1][3]

Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

APT37 has used the command-line interface.[1][3]

.005 Command and Scripting Interpreter: Visual Basic

APT37 executes shellcode and a VBA script to decode Base64 strings.[3]

Enterprise T1555 .003 Credentials from Password Stores: Credentials from Web Browsers

APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.[1]

Enterprise T1005 Data from Local System

APT37 has collected data from victims' local systems.[1]

Enterprise T1561 .002 Disk Wipe: Disk Structure Wipe

APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).[1][3]

Enterprise T1189 Drive-by Compromise

APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.[2][1]

Enterprise T1203 Exploitation for Client Execution

APT37 has used Flash Player (CVE-2016-4117, CVE-2018-4878) and Word (CVE-2017-0199) exploits for execution.[2][1][3]

Enterprise T1105 Ingress Tool Transfer

APT37 has downloaded second stage malware from compromised websites.[1][6]

Enterprise T1559 .002 Inter-Process Communication: Dynamic Data Exchange

APT37 has used Windows DDE for execution of commands and a malicious VBS.[2]

Enterprise T1036 .001 Masquerading: Invalid Code Signature

APT37 has signed its malware with an invalid digital certificates listed as "Tencent Technology (Shenzhen) Company Limited."[2]

Enterprise T1106 Native API

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.[3]

Enterprise T1027 Obfuscated Files or Information

APT37 obfuscates strings and payloads.[3][6]

.003 Steganography

APT37 uses steganography to send images to users that are embedded with shellcode.[3][6]

Enterprise T1120 Peripheral Device Discovery

APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. [6]

Enterprise T1566 .001 Phishing: Spearphishing Attachment

APT37 delivers malware using spearphishing emails with malicious HWP attachments.[1][3][6]

Enterprise T1057 Process Discovery

APT37's Freenki malware lists running processes using the Microsoft Windows API.[3]

Enterprise T1055 Process Injection

APT37 injects its malware variant, ROKRAT, into the cmd.exe process.[3]

Enterprise T1082 System Information Discovery

APT37 collects the computer name, the BIOS model, and execution path.[3]

Enterprise T1033 System Owner/User Discovery

APT37 identifies the victim username.[3]

Enterprise T1529 System Shutdown/Reboot

APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.[3]

Enterprise T1204 .002 User Execution: Malicious File

APT37 has sent spearphishing attachments attempting to get a user to open them.[1]

Enterprise T1102 .002 Web Service: Bidirectional Communication

APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.[1][3]

Software

ID Name References Techniques
S0212 CORALDECK [1] Archive Collected Data: Archive via Utility, Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, File and Directory Discovery
S0213 DOGCALL [1][7] Audio Capture, Ingress Tool Transfer, Input Capture: Keylogging, Obfuscated Files or Information, Screen Capture, Web Service: Bidirectional Communication
S0355 Final1stspy [7] Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Deobfuscate/Decode Files or Information, Obfuscated Files or Information, Process Discovery, System Information Discovery
S0214 HAPPYWORK [1] Ingress Tool Transfer, System Information Discovery, System Owner/User Discovery
S0215 KARAE [1] Drive-by Compromise, Ingress Tool Transfer, System Information Discovery, Web Service: Bidirectional Communication
S0247 NavRAT NavRAT is linked to APT37 with medium confidence.[8] Application Layer Protocol: Mail Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Data Staged: Local Data Staging, Ingress Tool Transfer, Input Capture: Keylogging, Process Discovery, Process Injection, System Information Discovery
S0216 POORAIM [1] Drive-by Compromise, File and Directory Discovery, Process Discovery, Screen Capture, System Information Discovery, Web Service: Bidirectional Communication
S0240 ROKRAT [3][6] Application Layer Protocol: Web Protocols, Audio Capture, Credentials from Password Stores: Credentials from Web Browsers, Credentials from Password Stores: Windows Credential Manager, Data from Local System, Exfiltration Over C2 Channel, File and Directory Discovery, Indicator Removal on Host: File Deletion, Ingress Tool Transfer, Input Capture: Keylogging, Process Discovery, Query Registry, Screen Capture, Software Discovery: Security Software Discovery, System Information Discovery, Virtualization/Sandbox Evasion: System Checks, Web Service: Bidirectional Communication
S0217 SHUTTERSPEED [1] Ingress Tool Transfer, Screen Capture, System Information Discovery
S0218 SLOWDRIFT [1] Ingress Tool Transfer, System Information Discovery, Web Service: Bidirectional Communication
S0219 WINERACK [1] Application Window Discovery, Command and Scripting Interpreter, File and Directory Discovery, Process Discovery, System Information Discovery, System Owner/User Discovery, System Service Discovery

References