Actors/Nation-state / APT/Asia

APT37

APTKP · North Korea

AKA RICOCHET CHOLLIMA · ScarCruft · Group 123 · Reaper Group · ATK4 · Operation Daybreak · InkySquid · Geumseong121

CrowdStrike: VELVET CHOLLIMAMicrosoft: Ruby Sleet

Targets16

Sectors19

Threat types1

GIRs covered0/480

Active since2012

Victimology

Geographic footprint · 16 countries

origin · North Koreatargeted countries · 16

ASIA · 7

China · Hong Kong · Indonesia · India · Japan · South Korea · Vietnam

EUROPE · 6

Germany · France · United Kingdom · Russia · Slovakia · Ukraine

AFRICA · 2

Egypt · South Africa

AMERICAS · 1

United States

Sectors targeted

19 of 40

Government83 actors Defense60 actors Aerospace49 actors Financial Services61 actors Cryptocurrency17 actors Healthcare38 actors Pharmaceutical24 actors Technology51 actors Retail & Hospitality25 actors NGOs & Dissidents47 actors Energy / Utilities49 actors Oil and Gas19 actors Education & Research50 actors Manufacturing (man)40 actors Media & Journalism41 actors Logistics18 actors Food and Beverage8 actors Consulting / Professional Services26 actors Private Sector (generic)28 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 25 techniques

Initial Access · 2

T1189Drive-by Compromise T1566.001Spearphishing Attachment

Execution · 7

T1053.005Scheduled Task

Persistence · 1

Credential Access · 1

T1555.003Credentials from Web Browsers

Discovery · 3

T1033System Owner/User Discovery

Collection · 2

T1005Data from Local System T1123Audio Capture

Impact · 2

T1529System Shutdown/Reboot

Command And Control · 3

T1071.001Web Protocols T1102.002Bidirectional Communication

Stealth · 4

T1027Obfuscated Files or Information

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1059

Command and Scripting Interpreter

T1059.003Windows Command Shell

T1059.005Visual Basic

T1059.006Python

T1106Native API

T1203Exploitation for Client Execution

T1547.001

Registry Run Keys / Startup Folder

T1057

Process Discovery

T1120Peripheral Device Discovery

T1561.002

Disk Structure Wipe

T1105

Ingress Tool Transfer

T1027.003

Steganography

T1036.001Invalid Code Signature

T1055Process Injection