APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Microsoft | Ruby Sleet |
| CrowdStrike | Ricochet Collima |
| Various | Reaper |
| OSINT | APT 37 |
| OSINT | Group 123 |
| OSINT | Group123 |
| OSINT | InkySquid |
| OSINT | Operation Daybreak |
| OSINT | Operation Erebus |
| OSINT | Reaper Group |
| OSINT | Red Eyes |
| OSINT | Ricochet Chollima |
| OSINT | ScarCruft |
| OSINT | Venus 121 |
| OSINT | ATK4 |
| OSINT | G0067 |
| OSINT | Moldy Pisces |
| OSINT | APT-C-28 |
| OSINT | PLAIN NEPTUNE |
| OSINT | TEMP.Reaper |
Sectors: Government, Private sector
Victim countries: South Korea, Japan, Vietnam
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names APT37, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT37. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.