SecurityOnlineDo Son
APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs
Part of the APT37 story · since 1 Sep 2025
Quiet for 7 weekslast report 16 Sep19 articles7 outlets
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs. This article, 16th of 19.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers.
The article discusses the APT37 NarwhalRAT malware, a sophisticated Python-based backdoor that targets Korean users via spear-phishing attacks. Attackers impersonate Microsoft in deceptive emails, prompting users to download malicious attachments. The infection occurs through a multi-stage process, including obfuscation tactics that avoid detection.
Key features of the malware include fileless execution, anti-virtual machine measures, and extensive data collection capabilities, such as keylogging and screen capturing. It establishes persistence on the victim's system and employs a dual command-and-control structure to blend its activity with legitimate cloud service traffic. The article emphasizes the need for organizations to strengthen cybersecurity defenses against such advanced threats.
How the story developed
Quiet for 7 weekslast report 16 Sep19 articles7 outlets
19 articles from 7 outlets since 1 Sep. Quiet since 16 Sep. This was the 16th report, 291 days after the first.
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs. This article, 16th of 19.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 19 articles as a listHide the list
- Mon 1 SepDay 02
- ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics08:45 · The Hacker News · First report
- North Korea’s APT37 deploys RokRAT in new phishing campaign against academics13:00 · Security Affairs
- Tue 2 SepDay 11
Quiet for 7 days
Tue 9 SepDay 81- APT37 Deploys New Rust and Python Malware Targeting Windows Systems07:05 · GBHackers · Picked up again
- Wed 10 SepDay 91
- APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer01:46 · SecurityOnline
Quiet for 9 weeks
Tue 11 NovDay 711- North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices01:00 · SecurityOnline · Picked up again
Quiet for 6 weeks
Wed 24 DecDay 1141- “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets01:50 · SecurityOnline · Picked up again
Quiet for 9 weeks
Fri 27 FebDay 1792- ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets13:26 · The Hacker News · Picked up again
- APT37 hits airgapped networks via USB in Ruby Jumper campaign14:28 · Infosecurity
Quiet for 3 days
Mon 2 MarDay 1822- APT37 targets airgapped systems using five tools in Ruby Jumper12:10 · SecurityWeek · Picked up again
- APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C213:42 · Security Affairs
Quiet for 6 weeks
Mon 13 AprDay 2241- North Korea APT37 uses fake Facebook to spread RokRAT via PDF10:32 · The Hacker News · Picked up again
Quiet for 3 weeks
Tue 5 MayDay 2462- ScarCruft deploys Android BirdCall backdoor via sqgame.net10:00 · The Hacker News · Picked up again
- North Korean Hackers Trojanise Korean Gaming Site to Spy on Users15:21 · Infosecurity
Quiet for 6 weeks
Tue 16 JunDay 2881- North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT08:50 · The Hacker News · Picked up again
Quiet for 3 days
Fri 19 JunDay 2911- APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs08:50 · SecurityOnline · Picked up again · This article, 16th of 19
Quiet for 4 weeks
Fri 17 JulDay 3191- North Korean APT37 uses Dropbox phishing to deliver RokRAT malware14:11 · SecurityOnline · Picked up again
Quiet for 8 weeks
Thu 10 SepDay 3741- Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea09:54 · SecurityOnline · Picked up again
Quiet for 6 days
Wed 16 SepDay 3801- North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers01:24 · Dark Reading · Picked up again