threat actor

APT37

unknownentity:threat_actor

APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: apt37
kind: threat actor
status: unknown
aliases: APT 37 · APT-C-28 · ATK4 · G0067 · Group 123 · Group123 · InkySquid · Moldy Pisces · Operation Daybreak · Operation Erebus · PLAIN NEPTUNE · Reaper · Reaper Group · Red Eyes · Ricochet Chollima · ScarCruft · TEMP.Reaper · Venus 121
jurisdictions: —
claims naming it: 0 · 0 attributions · 13 relations · 0 events

Identifiers

attack G0067via mitre-attack
misp-galaxy 50cd027f-df14-40b2-aa22-bf5de5061163via misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatAPT37usesBLUELIGHT
fetch —sha256 dc1639caa5501d72
rel_242btcintel:relations:242@v1 sha256:631c4b2797e65485
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesCORALDECK
fetch —sha256 dc1639caa5501d72
rel_243btcintel:relations:243@v1 sha256:5fc8b554c1d84997
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesKARAE
fetch —sha256 dc1639caa5501d72
rel_244btcintel:relations:244@v1 sha256:5d5cd01e0b389600
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesSLOWDRIFT
fetch —sha256 dc1639caa5501d72
rel_245btcintel:relations:245@v1 sha256:e21864a76e3c211a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesROKRAT
fetch —sha256 dc1639caa5501d72
rel_246btcintel:relations:246@v1 sha256:85c25a22675e3a6b
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesSHUTTERSPEED
fetch —sha256 dc1639caa5501d72
rel_247btcintel:relations:247@v1 sha256:95354f88ad904eb4
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesPOORAIM
fetch —sha256 dc1639caa5501d72
rel_248btcintel:relations:248@v1 sha256:87297bae4dc92ef0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesHAPPYWORK
fetch —sha256 dc1639caa5501d72
rel_249btcintel:relations:249@v1 sha256:759f5e0ad6766669
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesFinal1stspy
fetch —sha256 dc1639caa5501d72
rel_250btcintel:relations:250@v1 sha256:7fd41dba00f6783c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_251btcintel:relations:251@v1 sha256:0985200bd4d7dc93
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesNavRAT
fetch —sha256 dc1639caa5501d72
rel_252btcintel:relations:252@v1 sha256:86e91bc5fc8e8f41
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesDOGCALL
fetch —sha256 dc1639caa5501d72
rel_253btcintel:relations:253@v1 sha256:eac402198217f2f0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT37usesWINERACK
fetch —sha256 dc1639caa5501d72
rel_254btcintel:relations:254@v1 sha256:20cdac2fb3cfc485
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.