← threat actors
threat actor · KP
APT37
also tracked as scarcruft 3
related, not merged: Lazarus Group 18
4 stories · 4 in the wild · June 17, 2026 – July 13, 2026
evidence: 4 observed
how they got in
- phishing email 3 · Jun 20
malware and tools
- narwhalrat 3 · Jun 20
- rokrat 1 · Jul 13
techniques
- command and control 1 · Jul 13
- spear phishing 1 · Jun 18
attack phases seen
- Initial access 3 · Jun 20
- Command and control 1 · Jul 13
- Execution 1 · Jun 18
what we reported, newest first, grouped by story
July 13, 2026
- APT37 continues its cloud-based C2 model with RokRAT variants abusing pCloud, Dropbox and Yandex, reusing the same Yandex OAuth account and TTPs seen in prior Operation Artemis activity (blackorbird).
· Jul 13 · observed · Threat Activity
Jun 17 – June 20, 2026 · 3 reports
- ScarCruft (APT37) is delivering the new NarwhalRAT via spear-phishing impersonating Microsoft account security alerts. The Hacker News
· Jun 20 · observed · via phishing email · as scarcruft · Threat Intelligence & Espionage
- ScarCruft (APT37) delivered NarwhalRAT via spear-phishing impersonating Microsoft account security alerts, using Korean sites and pCloud for C2 (The Hacker News).
· Jun 18 · observed · via phishing email · as scarcruft · Threat Activity & Ransomware
- ScarCruft (APT37) used spear-phishing impersonating Microsoft account security alerts to deliver NarwhalRAT. The Hacker News.
· Jun 17 · observed · via phishing email · as scarcruft · Threat Activity