APT37
IntrusionSet · ATTACK:enterprise:G0067
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0067",
"title": "APT37",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0067",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--4a2ce82e-1a74-468a-a6fb-bbead541383c",
"external_id": "G0067",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2026-07-31T18:47:54.407Z",
"version": "2.0",
"aliases": [
"APT37",
"InkySquid",
"ScarCruft",
"Reaper",
"Group123",
"TEMP.Reaper",
"Ricochet Chollima"
],
"tactics": [
],
"source_references": [
{
"source_name": "Ricochet Chollima"
},
{
"source_name": "APT37"
},
{
"source_name": "Reaper"
},
{
"source_name": "Group123"
},
{
"source_name": "TEMP.Reaper"
},
{
"source_name": "ScarCruft"
},
{
"source_name": "InkySquid"
},
{
"source_name": "Volexity InkySquid BLUELIGHT August 2021",
"url": "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
},
{
"source_name": "CrowdStrike Richochet Chollima September 2021",
"url": "https://www.crowdstrike.com/adversaries/ricochet-chollima/"
},
{
"source_name": "FireEye APT37 Feb 2018",
"url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
},
{
"source_name": "Securelist ScarCruft May 2019",
"url": "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"
},
{
"source_name": "Talos Group123",
"url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"
},
{
"source_name": "Securelist ScarCruft Jun 2016",
"url": "https://securelist.com/operation-daybreak/75100/"
}
]
}Explicit source assertions (42)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0500bac5-bc50-4529-ae5f-b4e1a85fa7d7
FireEye APT37 Feb 2018 · Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09c8ec4f-c76b-4a36-994f-4ed4d87b7ad8
Securelist ScarCruft May 2019ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d4145da-e755-465f-a6fe-057ce43c627d
Volexity InkySquid RokRAT August 2021ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18c39a72-26d4-4e43-ad59-d3dcdacc592f
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--197a0e84-5361-49cc-8e14-24c331665862
Volexity InkySquid RokRAT August 2021 · Volexity InkySquid BLUELIGHT August 2021 · FireEye APT37 Feb 2018 · Securelist ScarCruft May 2019ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0212
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e27ff4a-fa86-46b1-8aea-748ec398b47e
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e363612-b503-47b2-b697-daf75ef3740a
Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fedf226-02b4-4634-a7bf-4dac49bd97a3
Talos Group123 · Securelist ScarCruft May 2019ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0215
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21c14374-e5a7-4a68-8ae8-12d5e47c1e63
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0218
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25e301f8-0bb7-4769-94be-ac96b2319c85
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32bb5463-c8b5-4ba1-bc13-b242548d5aba
FireEye APT37 Feb 2018 · Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ee8862f-2595-462e-8df8-aab639314b65
Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47415b89-a254-49a8-95c4-7efae85cac2c
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--490cc52d-1f6d-45d2-aa0e-2221264c0de0
Securelist ScarCruft Jun 2016ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a8f7699-3bcd-4586-b029-f43756681805
Securelist ScarCruft May 2019ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b253464-5a8b-4129-ab1b-ab888314f900
Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e596415-354e-4ccc-bc9d-3deb3fe5de1e
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63759ea4-5bf1-408d-a1cc-e7f52e3aca1b
Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--665d8625-e2d1-45d5-b5e3-d9bc0e242e7d
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0240
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7aea964a-cd9b-471e-bc7b-2a270c974289
Talos Group123 · Securelist ScarCruft May 2019ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fe2431d-30b9-45ef-8857-ecef17e428a9
Securelist ScarCruft Jun 2016ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82c9b9a1-5fbe-49e5-8685-12a03a66ef8d
Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84eee49c-e49a-40d1-bdc1-89c613636ef9
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--857b5ce3-0eb0-4dae-a034-42cfa306a447
Volexity InkySquid BLUELIGHT August 2021 · FireEye APT37 Feb 2018 · Talos Group123 · Securelist ScarCruft Jun 2016ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86f8bebc-a5fc-43d7-9af0-0024e07ca8d1
Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d88636c-32f1-4ea4-b7d9-948e48055d37
Talos Group123 · Securelist ScarCruft May 2019 · Volexity InkySquid RokRAT August 2021ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0216
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a39bea46-92a8-49cf-ae3f-d78f4d3f23cf
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6d35df2-0711-4b18-b733-6200467056ec
Volexity InkySquid BLUELIGHT August 2021 · FireEye APT37 Feb 2018 · Securelist ScarCruft Jun 2016ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9b92f28-c273-48cf-8ee6-dfa6c240cda9
Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b906b0a1-12a3-4d6f-82ec-d72a4ef711b4
Volexity InkySquid RokRAT August 2021ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0214
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baa9bb45-b4d2-4eea-803f-d2d1126330d4
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cae6bbd0-d00e-4cc4-872a-d3ac9cc97684
FireEye APT37 Feb 2018 · Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0061edc-becf-4ce9-ae91-5e1816d4a894
FireEye APT37 Feb 2018 · Securelist ScarCruft May 2019 · Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0355
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e18e5899-894b-4889-b008-77b44dbc0fce
Unit 42 Nokki Oct 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0154
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e614a9ca-a922-4594-a929-30dd542d83ce
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e66427b2-f353-446a-aedf-decccb926172
FireEye APT37 Feb 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0247
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6f81b9c-8fda-49f5-a944-265f5bad82ba
Talos NavRAT May 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7e7718a-b0e1-48cb-a9e8-bcbd0cf25cec
Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f540a7ab-541a-44a5-8b6a-96b42b044d5b
Volexity InkySquid RokRAT August 2021ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcb6fc55-8fa6-4ec7-a5a3-51de7dd90c1d
FireEye APT37 Feb 2018 · Talos Group123ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcdfad8a-73d5-4d8f-ab0d-24f847d675a0
FireEye APT37 Feb 2018 · Unit 42 Nokki Oct 2018ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fdf161e2-46dc-41ee-bec4-9b18c8b1e6d9
FireEye APT37 Feb 2018