Watch Floor
State-backedNorth KoreaMITRE G0067

APT37

Also known as APT 37, Group 123, Group123, InkySquid, Operation Daybreak, Operation Erebus, Reaper Group, Reaper, Red Eyes, Ricochet Chollima, ScarCruft, Venus 121, ATK4, G0067, Moldy Pisces, APT-C-28, PLAIN NEPTUNE, TEMP.Reaper

1mentions, 7 days
2mentions, 30 days
Nov 3, 2026last mentioned

APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities

Targets: Government, Private sector, South Korea, Japan, Vietnam

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1005 Data from Local SystemT1027 Obfuscated Files or InformationT1027.003 SteganographyT1033 System Owner/User DiscoveryT1036.001 Invalid Code SignatureT1053.005 Scheduled TaskT1055 Process InjectionT1057 Process DiscoveryT1059 Command and Scripting InterpreterT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.006 PythonT1071.001 Web ProtocolsT1082 System Information DiscoveryT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1106 Native APIT1120 Peripheral Device DiscoveryT1123 Audio CaptureT1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1529 System Shutdown/RebootT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account ControlT1555.003 Credentials from Web BrowsersT1559.002 Dynamic Data ExchangeT1561.002 Disk Structure WipeT1566.001 Spearphishing Attachment

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.