In the spotlight this week: After a brief period of inactivity, the North Korean threat group “APT37” has been blamed for yet another cyber-espionage campaign involving spearphishing, this time using lures mentioning North Korean refugees.
The March 2020 campaign used cloud-related platforms to distribute malware, evade detection, and minimize the group’s footprint―a popular tactic of APT37. Because the spearphishing emails contained hyperlinks that led to malicious files, the emails were able to bypass many security tools, as there were no attachments to be analyzed and deemed malicious. This campaign marked APT37’s first appearance since Microsoft seized 50 of the group’s web domains in December 2019. Despite that recent setback, the group clearly remains persistent and committed to gathering foreign intelligence.
