APT37
Attribution profile
- Type
- Nation State
- Location
- North Korea
- Known incidents
- 3 incidents
- Sources
- 1 source
- First seen
- 2021-02-04
- Last seen
- 2026-03-01
- Updated
- 2026-10-13 19:00
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Famous Chollima, also known as Void Dokkaebi, ScarCruft and APT37, is a North Korean threat actor. In 2015 it was blamed by South Korea for a phishing campaign that delivered kimsuky‑like malware to Korea Hydro and Nuclear Power employees, stole personal data and demanded an unspecified payment while threatening to shut down three reactors. In 2021 the actor conducted a ransomware attack on the administrative network of Brazil’s Eletrobras nuclear subsidiary, which led to the suspension of administrative software but left operational systems unaffected. Beginning in 2026 the actor used fake job offers to lure developers into cloning repositories containing malicious Visual Studio Code tasks hidden in the .vscode folder; executing the task upon opening the project in VS Code and committing the changes to GitHub propagated the compromise, infecting over 750 repositories including those of DataStax and Neutralinojs and spreading remote access Trojans and other malware through the software supply chain.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 1 source.