North KoreaAssessedMinistry of State SecurityEspionageActive 2012 – 2026ScarCruft
Also known asReaper · Group123 · InkySquid · Ricochet Chollima · Red Eyes · Venus 121 · TEMP.Reaper · Geumseong121 · Hermit · ATK 4 · ITG10 · Moldy Pisces · TA-RedAnt · Reaper Group · APT-C-28 · NICKEL FOXCROFT
Summary
North Korean group (Mandiant: assessed alignment with the Ministry of State Security) targeting South Korean government, defectors, and foreign policy entities. Exploits Hangul Word Processor (HWP) vulnerabilities. RokRAT uses OneDrive/Dropbox as C2 channels.
Attribution
AssessedResearch assessment: Ministry of State Security
North Korean MSS; tasking unclear since 2023 (Mandiant)
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
Sources
- Mandiant (Research, 2023-10-10)
Aligns APT37 with the Ministry of State Security - Mandiant (Research, 2023-10-10)
Unknown since 2023 whether it remains MSS-tasked - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
North Korean state-sponsored
Campaigns 6
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| BlankOverride worm (BLUELIGHT) at port infrastructure in an African country | 2026-04 – 2026-09 | Africa | Maritime | ESET Research (2026-10-28) — within ESET's Apr–Sep 2026 reporting period; the country is not named |
| Fake Zangi Messenger site — BirdCall for Android, BlueStacks installer leading to RokRAT | 2026-04 – 2026-09 | Undisclosed | Undisclosed | ESET Research (2026-10-28) — within ESET's Apr–Sep 2026 reporting period; victims not named |
| Ruby Jumper — Zoho WorkDrive C2 and removable-media air-gap bridging | 2025-12 | Zscaler ThreatLabz (2026-02-26) | ||
| Facebook pretexting — trojanised PDFelement viewer for "encrypted military documents" → RokRAT | 2025-11 – 2026-04 | South Korea | Defense, Individuals | Genians Security Center (2026-04-13) |
| Operation HanKook Phantom | 2025 – 2025-08 | South Korea | Academia, Government, Think Tanks | Seqrite Labs (2025-08-29) |
| Yanbian gaming-platform supply chain (sqgame) — RokRAT and Android/Windows BirdCall | 2024 – ongoing | China (Yanbian) | Gaming, Defectors / Refugees | ESET (2026-05-05) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Initial Access2 | T1566.001Spearphishing AttachmentT1195.002Compromise Software Supply Chain |
|---|---|
| Execution2 | T1203Exploitation for Client ExecutionT1059.005Visual Basic |
| Collection1 | T1560Archive Collected Data |
| Command and Control2 | T1102Web ServiceT1092Communication Through Removable Media |
Malware and tools 12
| Name | Description | Platform |
|---|---|---|
| RokRAT | Cloud-based RAT | Windows |
| Goldbackdoor | Backdoor | Windows |
| DOGCALL | Backdoor | Windows |
| Chinotto | Backdoor | Windows |
| Dolphin | Espionage Implant | Windows |
| RESTLEAF | Implant / downloader (Zoho WorkDrive C2) | Windows |
| VIRUSTASK | Removable-media propagation component (Ruby) | Windows |
| FOOTWINE | Surveillance backdoor | Windows |
| BirdCall | Espionage backdoor (screenshots, keylogging, files, audio; Dropbox/pCloud C2) | Windows/Android |
| BlankOverride | Worm (removable drives) | Windows |
| BLUELIGHT | Backdoor | Windows |
| CinderRelay | Backdoor / covert-network node | Linux |
Exploited vulnerabilities 6
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-26411 | 8.8 | Internet Explorer Memory Corruption (KEV 2021-11-03) |
| CVE-2022-41128 | 8.8 | Windows Scripting Languages RCE (KEV 2022-11-08) |
| CVE-2016-4117 | 7.8 | Adobe Flash Player — type confusion RCE (KEV 2022-03-03) |
| CVE-2017-0199 | 7.8 | Microsoft Office/WordPad — RTF/HTA RCE (KEV 2021-11-03) |
| CVE-2018-4878 | 7.8 | Adobe Flash Player — use-after-free RCE (KEV 2021-11-03) |
| CVE-2020-1380 | 7.8 | Internet Explorer scripting engine — memory corruption RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Compromised South Korean websites host payloads; Zoho WorkDrive as C&C storage (ESET, 2026)
- A compromised game update server (sqgame) used to push trojanised updates (ESET, 2026)
- CinderRelay on compromised South Korean Linux servers forms a covert relay network (ESET, 2026)
Reporting and advisories 7
- Mandiant
APT37: North Korea's Overlooked Threat Actor - Zscaler ThreatLabz
Ruby Jumper — Zoho WorkDrive C2 and removable-media air-gap bridging - Seqrite Labs
Operation HanKook Phantom - ESET
Yanbian gaming-platform supply chain (sqgame) — RokRAT and Android/Windows BirdCall - MITRE ATT&CK
ScarCruft (G0067) group profile - Genians Security Center
Facebook pretexting — trojanised PDFelement viewer for "encrypted military documents" → RokRAT - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)