APT37
APT37 is a suspected North Korean cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, Northern Korean Human Rights, and Evil New Year 2018. [1] [2] [3]
North Korean group definitions are known to have significant overlap, and the name Lazarus Group is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea.[4] Some organizations track North Korean clusters or groups such as Bluenoroff,[5] APT37, and APT38 separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.
Associated Group Descriptions
| Name | Description |
|---|---|
| ScarCruft | |
| Reaper | |
| Group123 | |
| TEMP.Reaper |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1548 | .002 | Abuse Elevation Control Mechanism: Bypass User Account Control |
APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.[6] |
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
| Enterprise | T1123 | Audio Capture |
APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.[1] |
|
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
APT37's has added persistence via the Registry key |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell | |
| .005 | Command and Scripting Interpreter: Visual Basic |
APT37 executes shellcode and a VBA script to decode Base64 strings.[3] |
||
| Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.[1] |
| Enterprise | T1005 | Data from Local System | ||
| Enterprise | T1561 | .002 | Disk Wipe: Disk Structure Wipe |
APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).[1][3] |
| Enterprise | T1189 | Drive-by Compromise |
APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.[2][1] |
|
| Enterprise | T1203 | Exploitation for Client Execution |
APT37 has used Flash Player (CVE-2016-4117, CVE-2018-4878) and Word (CVE-2017-0199) exploits for execution.[2][1][3] |
|
| Enterprise | T1105 | Ingress Tool Transfer |
APT37 has downloaded second stage malware from compromised websites.[1][6] |
|
| Enterprise | T1559 | .002 | Inter-Process Communication: Dynamic Data Exchange |
APT37 has used Windows DDE for execution of commands and a malicious VBS.[2] |
| Enterprise | T1036 | .001 | Masquerading: Invalid Code Signature |
APT37 has signed its malware with an invalid digital certificates listed as "Tencent Technology (Shenzhen) Company Limited."[2] |
| Enterprise | T1106 | Native API |
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.[3] |
|
| Enterprise | T1027 | Obfuscated Files or Information | ||
| .003 | Steganography |
APT37 uses steganography to send images to users that are embedded with shellcode.[3][6] |
||
| Enterprise | T1120 | Peripheral Device Discovery |
APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. [6] |
|
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
APT37 delivers malware using spearphishing emails with malicious HWP attachments.[1][3][6] |
| Enterprise | T1057 | Process Discovery |
APT37's Freenki malware lists running processes using the Microsoft Windows API.[3] |
|
| Enterprise | T1055 | Process Injection |
APT37 injects its malware variant, ROKRAT, into the cmd.exe process.[3] |
|
| Enterprise | T1082 | System Information Discovery |
APT37 collects the computer name, the BIOS model, and execution path.[3] |
|
| Enterprise | T1033 | System Owner/User Discovery | ||
| Enterprise | T1529 | System Shutdown/Reboot |
APT37 has used malware that will issue the command |
|
| Enterprise | T1204 | .002 | User Execution: Malicious File |
APT37 has sent spearphishing attachments attempting to get a user to open them.[1] |
| Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |
APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.[1][3] |
Software
References
- FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
- Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.
- Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
- US-CERT. (2017, June 13). Alert (TA17-164A) HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure. Retrieved July 13, 2017.
- GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.
- GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.
- Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.
- Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.