The Hacker Newsinfo@thehackernews.com (The Hacker News)
North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT
Part of the APT37 story · since 1 Sep 2025
Quiet for 6 weekslast report 16 Sep19 articles7 outlets
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT. This article, 15th of 19.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers.
The article discusses the use of fake Microsoft alerts to deploy NarwhalRAT malware by North Korean attackers. This malware allows remote access to infected systems, posing significant security threats. The report emphasizes the growing sophistication of cyber attacks and the importance of vigilance against phishing schemes that leverage such fake alerts. It includes insights on related cybersecurity resources and emphasizes modern cybersecurity measures, such as zero trust, to combat such threats.
How the story developed
Quiet for 6 weekslast report 16 Sep19 articles7 outlets
19 articles from 7 outlets since 1 Sep. Quiet since 16 Sep. This was the 15th report, 288 days after the first.
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT. This article, 15th of 19.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 19 articles as a listHide the list
- Mon 1 SepDay 02
- ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics08:45 · The Hacker News · First report
- North Korea’s APT37 deploys RokRAT in new phishing campaign against academics13:00 · Security Affairs
- Tue 2 SepDay 11
Quiet for 7 days
Tue 9 SepDay 81- APT37 Deploys New Rust and Python Malware Targeting Windows Systems07:05 · GBHackers · Picked up again
- Wed 10 SepDay 91
- APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer01:46 · SecurityOnline
Quiet for 9 weeks
Tue 11 NovDay 711- North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices01:00 · SecurityOnline · Picked up again
Quiet for 6 weeks
Wed 24 DecDay 1141- “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets01:50 · SecurityOnline · Picked up again
Quiet for 9 weeks
Fri 27 FebDay 1792- ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets13:26 · The Hacker News · Picked up again
- APT37 hits airgapped networks via USB in Ruby Jumper campaign14:28 · Infosecurity
Quiet for 3 days
Mon 2 MarDay 1822- APT37 targets airgapped systems using five tools in Ruby Jumper12:10 · SecurityWeek · Picked up again
- APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C213:42 · Security Affairs
Quiet for 6 weeks
Mon 13 AprDay 2241- North Korea APT37 uses fake Facebook to spread RokRAT via PDF10:32 · The Hacker News · Picked up again
Quiet for 3 weeks
Tue 5 MayDay 2462- ScarCruft deploys Android BirdCall backdoor via sqgame.net10:00 · The Hacker News · Picked up again
- North Korean Hackers Trojanise Korean Gaming Site to Spy on Users15:21 · Infosecurity
Quiet for 6 weeks
Tue 16 JunDay 2881- North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT08:50 · The Hacker News · Picked up again · This article, 15th of 19
Quiet for 3 days
Fri 19 JunDay 2911- APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs08:50 · SecurityOnline · Picked up again
Quiet for 4 weeks
Fri 17 JulDay 3191- North Korean APT37 uses Dropbox phishing to deliver RokRAT malware14:11 · SecurityOnline · Picked up again
Quiet for 8 weeks
Thu 10 SepDay 3741- Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea09:54 · SecurityOnline · Picked up again
Quiet for 6 days
Wed 16 SepDay 3801- North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers01:24 · Dark Reading · Picked up again