Actors/Nation-state / APT/Asia

APT37

G0067APTKP · North Korea

AKA RICOCHET CHOLLIMA · ScarCruft · Group 123 · Reaper Group · ATK4 · Operation Daybreak · InkySquid · Geumseong121

CrowdStrike: VELVET CHOLLIMAESET: ReaperMicrosoft: Ruby SleetMITRE: G0067Proofpoint: TA406Secureworks: IRON TILDEN

Targets16

Sectors19

Threat types1

GIRs covered0/480

Active since2012

Also tracked as

7 vendor names · 8 other aliases

Open Rosetta Stone

CrowdStrike

VELVET CHOLLIMA

ESET

Reaper

Mandiant

APT37

Microsoft

Ruby Sleet

MITRE

G0067

Proofpoint

TA406

Secureworks

IRON TILDEN

UNATTRIBUTED ALIASESRICOCHET CHOLLIMAScarCruftGroup 123Reaper GroupATK4Operation DaybreakInkySquidGeumseong121

Victimology

Geographic footprint · 16 countries

origin · North Koreatargeted countries · 16

ASIA · 7

China · Hong Kong · Indonesia · India · Japan · South Korea · Vietnam

EUROPE · 6

Germany · France · United Kingdom · Russia · Slovakia · Ukraine

AFRICA · 2

Egypt · South Africa

AMERICAS · 1

United States

Sectors targeted

19 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Cryptocurrency21 actors Healthcare47 actors Pharmaceutical27 actors Technology60 actors Retail & Hospitality33 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Logistics22 actors Food and Beverage10 actors Consulting / Professional Services35 actors Private Sector (generic)29 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 25 techniques

Initial Access · 2

T1189Drive-by Compromise T1566.001Spearphishing Attachment

Execution · 7

T1053.005Scheduled Task

Persistence · 1

Credential Access · 1

T1555.003Credentials from Web Browsers

Discovery · 3

T1033System Owner/User Discovery

Collection · 2

T1005Data from Local System T1123Audio Capture

Impact · 2

T1529System Shutdown/Reboot

Command And Control · 3

T1071.001Web Protocols T1102.002Bidirectional Communication

Stealth · 4

T1027Obfuscated Files or Information

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer25 techniques · layer format 4.5

Related actors

By origin and actor type

T1059

Command and Scripting Interpreter

T1059.003Windows Command Shell

T1059.005Visual Basic

T1059.006Python

T1106Native API

T1203Exploitation for Client Execution

T1547.001

Registry Run Keys / Startup Folder

T1057

Process Discovery

T1120Peripheral Device Discovery

T1561.002

Disk Structure Wipe

T1105

Ingress Tool Transfer

T1027.003

Steganography

T1036.001Invalid Code Signature

T1055Process Injection