apt37-reaper-the-overlooked-north-korean-actor.pdf

CONTENTS

Introduction 3

Targeting and Mission 4

Initial Infection Vectors 7

Exploited Vulnerabilities 8

Command and Control Infrastructure 9

Malware 10

Attribution 12

Outlook and Implications 13

Appendix: Malware Used by APT37 14

SPECIAL REPORT2

INTRODUCTION

On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye iSIGHT Intelligence reveals APT37 has expanded its operations in both scope and sophistication. APT37’s toolset, which includes access to zero-day vulnerabilities and wiper malwa…