APT37
aka ScarCruft, Reaper, Ricochet Chollima, InkySquid, TA-RedAnt, Group123
A North Korean state-sponsored spy group that mainly targets South Korean officials, defectors and researchers, with Japan also on its list. It has repeatedly used unknown browser flaws.
- Alert level
- 3/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 2
- Personal data leaked (disclosed)
- None confirmed
Attribution
- North Korean state-sponsored espionage group; targets include South Korea and Japan — MITRE ATT&CK
- Assessed as North Korean government-backed APT37 — Google Threat Analysis Group
Exploited vulnerabilities and targeted products
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Entry
Hijacking an ad server
Like sneaking into the print shop for a daily flyer and slipping a trap into every copy handed out in town.
Entry
Targeted phishing emails
Like a letter that seems to come from a colleague, with an envelope that springs a trap when opened.
Inside
Hiding in ordinary cloud services
Like smuggling stolen goods out inside the boxes of a delivery service that visits every day.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily