APT37

APT37 targets journalists and researchers working on North Korea, defectors, human-rights organisations and the South Korean public sector, overlapping with Kimsuky. Its distinguishing feature is continuity of tooling: RokRAT has been attributed to it since 2016 and is still found in campaigns reported this year, rebuilt but recognisably the same.

Its reporting yields file hashes, command-and-control domains and addresses, unlike the email addresses, GitHub accounts and personas of the revenue-generating clusters. Both sit in the same index deliberately, since a defender holding one of these values does not care which side of the regime's ledger it came from.

Named individuals

None profiled on this site yet

Fabricated personas

None reconstructed under this tag

Indicators

598 in the searchable index

Hunts

None in the hunt library

How it differs from the other clusters here

Delivery suits a Korean desktop: shortcut files with oversized embedded payloads, Hancom Office documents, and Korean-language lures about Korean policy.

Cloud storage and ordinary developer services carry command and control, so traffic looks like services the endpoint already uses.

It adopts whatever is newly ordinary, such as steganographic image loaders and commodity artificial-intelligence tooling, with the same implant underneath.

Compare Lazarus GroupAPT38KimsukyRGB (Reconnaissance General Bureau)Remote Worker Fraud / Contagious InterviewAndarielKonniMoonstone SleetPolinRider

What a defender would see

An oversized shortcut file is the most useful signal: genuine ones are a few kilobytes, those with an embedded script and decoy hundreds or more.

That size difference survives repeated retooling of the rest of the chain.

Otherwise watch for unfamiliar document formats, an office application spawning a scripting host, and unexpected outbound cloud-storage connections.

Hashes and infrastructure age quickly; these behavioural shapes do not.

Indicators

The 598 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from

Show 50 more

Further reading

Published research on this cluster. None of it is this site’s work.

• APT37: Mitre ATT&CK group entry MITRE · 2026-07-31

  Dated to the entry's last modification on ATT&CK.