← Back to all threat actors

APT37

Also known as InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima
Tracked as G0067

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

How we source and review actor profiles
Motivation
nation-state
Sectors
government, defense, media-journalism, ngo
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
IdentityAlias: InkySquid

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: ScarCruft

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Reaper

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Group123

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: TEMP.Reaper

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Ricochet Chollima

Reviewed identity mapping approved on this date.

Cataloged
IdentityTracking identifier: G0067

Reviewed identity mapping approved on this date.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

APT37Canonical Name
Group123Alias
InkySquidAlias
ReaperAlias
Ricochet ChollimaAlias
ScarCruftAlias
TEMP.ReaperAlias
G0067Tracking Id

Loading CVEs, techniques, indicators, malware, victims, and activity...