{
  "name": "Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2",
  "slug": "analysis-of-apt37-narwhalrat-leveraging-ms-themed-phishing-and-dead-drop-c2",
  "description": "A sophisticated Python-based RAT targeting Korean users through spear phishing emails disguised as Microsoft security alerts. The attack chain employs LNK files embedded in ZIP archives, BAT-based obfuscation, and multi-stage loaders culminating in NarwhalRAT deployment. This advanced malware features keylogging, screen capture, microphone recording, and USB data collection capabilities. It utilizes a dual C2 infrastructure combining Korean relay servers (daehoat.com, novel21.co.kr) with pCloud API as a dead-drop resolver. The malware creates encrypted configuration files, implements anti-VM techniques, and establishes persistence through scheduled tasks. It operates as a manually-controlled RAT with selective function activation via C2 commands, employing in-memory execution to evade file-based detection.",
  "published": "2026-06-15T14:58:18.238000+00:00",
  "created_at": "2026-06-15T17:46:04.778000+00:00",
  "modified_at": "2026-06-15T15:46:04+00:00",
  "created_at_opencti": "2026-06-15T17:46:04.778000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "anti-vm",
    "dead-drop-resolver",
    "korean-targeting",
    "lnk-obfuscation",
    "narwhalrat",
    "pcloud",
    "python-backdoor",
    "rokrat",
    "spear-phishing"
  ],
  "tags": [
    "2026-06-15",
    "anti-vm",
    "dead drop resolver",
    "korean targeting",
    "lnk-obfuscation",
    "narwhalrat",
    "pcloud",
    "python backdoor",
    "rokrat",
    "spear-phishing"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "0129ecb7-d7d3-4186-a226-38a2baa88eb0",
        "name": "novel21.co.kr"
      },
      {
        "id": "36762ea6-fe77-496c-acbc-f9ed37b7f4af",
        "name": "218.150.78.198"
      },
      {
        "id": "efe35cb1-9db8-4930-8ae8-0615e256c10b",
        "name": "http://www.novel21.co.kr/data/editor/2110/index.php"
      },
      {
        "id": "1d0aa568-7443-46e6-a9c2-8d507744960a",
        "name": "www.novel21.co.kr"
      },
      {
        "id": "e0a82261-de32-49b0-808e-6b700f044076",
        "name": "fe01.co.kr"
      },
      {
        "id": "a60589ce-a0f2-4350-aea5-a40ea0531cba",
        "name": "61.100.9.206"
      },
      {
        "id": "b280f6fa-637a-45c5-8c97-b7081a4f8b8b",
        "name": "121.254.222.80"
      },
      {
        "id": "b28beafb-26e3-40b2-92ee-bc0353cd046c",
        "name": "crwellfood.com"
      },
      {
        "id": "f234e2ef-ebc6-4303-9212-b2e2253d4296",
        "name": "218.150.78.231"
      },
      {
        "id": "ae316e1a-3120-4802-b298-525314ed0f66",
        "name": "webhostingkorea.com"
      },
      {
        "id": "8eab4b54-7057-4923-96e3-431cac20b3f3",
        "name": "121.254.222.10"
      },
      {
        "id": "793774a1-99f1-4020-965f-1fa0aa1420a4",
        "name": "211.239.157.126"
      }
    ],
    "intrusion_sets": [
      {
        "id": "950aa317-d079-47cd-913e-10433cf55ecc",
        "name": "APT37",
        "slug": "apt37"
      }
    ],
    "attack_patterns": [
      {
        "id": "0cad3bc9-06c8-4bb1-b85b-cdcb64605ead",
        "name": "T1025"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "d3254e3b-07e6-4420-96e0-2e107ce17712",
        "name": "T1102.001"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "845f5e29-c9e5-43e7-aa28-6d7afc88b850",
        "name": "NarwhalRAT",
        "slug": "narwhalrat"
      },
      {
        "id": "df02a7ff-d258-46c0-87a1-745be7c680b4",
        "name": "ROKRAT - S0240",
        "slug": "rokrat-s0240"
      }
    ],
    "observables": [
      {
        "id": "a82bc57f-2a6b-46f6-9f8a-eaf216dd3e7d",
        "name": "crwellfood.com"
      },
      {
        "id": "0fc88fb4-3d35-4559-8a98-a5a1f1793d1f",
        "name": "webhostingkorea.com"
      },
      {
        "id": "8919fd25-9e59-40aa-a057-96f608cf177a",
        "name": "novel21.co.kr"
      },
      {
        "id": "d6032a39-0274-45a3-8d6f-627b5700f500",
        "name": "fe01.co.kr"
      },
      {
        "id": "1035b180-a62d-4288-99cb-b0fae6b8337e",
        "name": "www.novel21.co.kr"
      },
      {
        "id": "8c2d6894-4def-4131-ab99-a2b04882cea9",
        "name": "121.254.222.80"
      },
      {
        "id": "95f18639-9c52-4070-8d94-01ce79f23fd1",
        "name": "218.150.78.198"
      },
      {
        "id": "ef0d017d-f45e-4583-8c72-867f0ae08e14",
        "name": "211.239.157.126"
      },
      {
        "id": "48aa49c9-03d2-49f9-aef1-b8b77e21e765",
        "name": "121.254.222.10"
      },
      {
        "id": "337691e4-d62a-4056-b0a9-c0b3f6e3f61e",
        "name": "218.150.78.231"
      },
      {
        "id": "65474220-b3ec-4375-9112-9aa24c73dd8e",
        "name": "61.100.9.206"
      },
      {
        "id": "8a5471ed-0d60-48c2-b5a9-255b5e41e1fc",
        "name": "http://www.novel21.co.kr/data/editor/2110/index.php"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "novel21.co.kr"
      },
      {
        "id": "",
        "name": "fe01.co.kr"
      },
      {
        "id": "",
        "name": "crwellfood.com"
      },
      {
        "id": "",
        "name": "webhostingkorea.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "1e7c0a40-1c29-47c4-9ec8-17daebd76fac",
      "standard_id": "external-reference--afa89554-c4c8-5cbd-b07f-2fe3c7572fdd",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.genians.co.kr/en/blog/threat_intelligence/narwhalrat",
      "hash": null,
      "external_id": null,
      "created": "2026-06-15T17:45:57.943Z",
      "modified": "2026-06-15T17:45:57.943Z",
      "createdById": null
    },
    {
      "id": "f18bce0e-b4a1-4c0e-8c02-a9fb6ff74d36",
      "standard_id": "external-reference--f65329a2-9ba8-5e55-94a7-77a2619a344f",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a30130ad416e33ebf9e9417",
      "hash": null,
      "external_id": "6a30130ad416e33ebf9e9417",
      "created": "2026-06-15T17:45:57.912Z",
      "modified": "2026-06-15T17:45:57.912Z",
      "createdById": null
    }
  ]
}