High

Analysis Summary

APT37, also known as ScarCruft or Red Eyes, is a North Korean state-sponsored espionage group active since at least 2012. While historically focused on South Korea, the group has expanded its targeting across Asia, the Middle East, and Europe. It has led several notable operations such as Operation Daybreak, Erebus, Golden Time, and Evil New Year, all centered on intelligence collection, disruption, and high-value data theft.

A core tool associated with APT37 is RokRAT, a sophisticated remote-access trojan repeatedly used across its campaigns. By 2025, APT37 continues to evolve its techniques and has shifted to distributing RokRAT through malicious LNK files, moving away from earlier HWP and Word document lures. These LNK files contain PowerShell commands that deploy additional scripts and payloads through temporary directories, enabling a stealthy infection process.

RokRAT’s effectiveness remains rooted in its in-memory execution, encrypted communications, and use of legitimate cloud services such as Dropbox, pCloud, OneDrive, and Yandex Cloud for command-and-control. It also gathers machine-specific information to validate victims and tailor follow-on actions. In 2025, APT37’s continued use and adaptation of RokRAT demonstrates the group’s persistence and growing sophistication, reinforcing its status as a significant cyber threat.

Impact

• Information Theft and Espionage

Indicators of Compromise

SHA1

• 206f60ff637580b3a06811dc9647df77de60317b

• b26a769254487129d64e1043a3eb3a9cbc5ac5fc

• c53bdf6c05c13186a622ed9fd67f9edf2662bd47

• 536d9332e34a2332b1d027fc45b01e0e5419a7cf

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.