APT37 — Threat Actors — SecurityStudies.info

Profile

Also known as: APT 37, APT-C-28, ATK4, G0067, Group 123, Group123, InkySquid, Moldy Pisces, Operation Daybreak, Operation Erebus, PLAIN NEPTUNE, Reaper, Reaper Group, Red Eyes, Ricochet Chollima, ScarCruft, TEMP.Reaper, Venus 121

APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities

Related profiles: Opal Sleet

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques · 29

Initial Access

T1189Drive-by Compromise T1566.001Spearphishing Attachment

Execution

T1053.005Scheduled Task T1059Command and Scripting Interpreter T1059.003Windows Command Shell T1059.005Visual Basic T1059.006Python T1106Native API T1203Exploitation for Client Execution T1204.002Malicious File T1559.002Dynamic Data Exchange

Persistence

T1547.001Registry Run Keys / Startup Folder

Privilege Escalation

T1055Process Injection T1548.002Bypass User Account Control

Stealth

T1027Obfuscated Files or Information T1027.003Steganography T1036.001Invalid Code Signature

Credential Access

T1555.003Credentials from Web Browsers

Discovery

T1033System Owner/User Discovery T1057Process Discovery T1082System Information Discovery T1120Peripheral Device Discovery

Collection

T1005Data from Local System T1123Audio Capture

Command and Control

T1071.001Web Protocols T1102.002Bidirectional Communication T1105Ingress Tool Transfer

Impact

T1529System Shutdown/Reboot T1561.002Disk Structure Wipe

Incidents attributed

High North Korean 'ted' Linux Backdoor Found Inside Trojanised HAProxy at South Korean Firms
Sep 4, 2026 · South Korea · Espionage
High North Korea-linked backdoor found compiled inside HAProxy at two South Korean companies
Sep 1, 2026 · South Korea · Espionage

In the news

Updated Cyber Threat Actor Naming System
Google Threat Intelligence · Jul 24, 2026

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential