Operation HanKook Phantom: APT37’s Stealthy Espionage Campaign

Operation HanKook Phantom: APT37’s Stealthy Espionage Campaign

Summary

In 2025, APT37, a North Korean advanced persistent threat (APT) group also known as Reaper, Ricochet Chollima, ScarCruft, and Red Eyes, launched a stealthy cyber espionage campaign named Operation HanKook Phantom. The campaign targeted South Korea’s academic institutions, government officials, and researchers, leveraging Windows-based attacks with the ROKRAT malware. Using malicious shortcut (LNK) files and spear-phishing emails disguised as newsletters, APT37 successfully deployed fileless malware to steal sensitive data. The group used trusted cloud services like Dropbox, pCloud, and Yandex for covert exfiltration, making detection difficult.

Attack Details

APT37 used weaponized LNK files attached to phishing emails masquerading as South Korean research newsletters. These LNK files triggered embedded PowerShell scripts that unpacked multiple payloads, including disguised PDFs and binary loaders, into temporary directories. The infection chain executed entirely in memory, complicating forensic analysis.

The final payload, ROKRAT, enabled host fingerprinting, screenshot capture, system reconnaissance, and seamless data exfiltration via cloud services. APT37 also distributed politically charged lures, such as documents attributed to Kim Yo-jong, to increase credibility. These decoys followed the same LNK-based delivery chain, deploying obfuscated scripts and encoded payloads that exfiltrated files disguised as PDFs through HTTP POST requests before erasing local traces.

Recommendations

• Exercise caution with unexpected files: Avoid opening unsolicited newsletters, PDFs, or shortcut (LNK) files.

• Identify suspicious LNK extensions: Double extensions (e.g., .pdf.lnk) should be flagged as malicious.

• Promote a “pause before click” culture: Encourage staff, especially in sensitive sectors, to verify suspicious attachments.

• Strengthen endpoint protection: Deploy NGAV and EDR tools with behavioral and machine-learning detection to catch memory-resident threats.

Indicators of Compromise (IoCs)

MD5 Hashes

• 1aec7b1227060a987d5cb6f17782e76e

• 591b2aaf1732c8a656b5c602875cbdd9

• d035135e190fb6121faa7630e4a45eed

• cc1522fb2121cf4ae57278921a5965da

• 2dc20d55d248e8a99afbe5edaae5d2fc

• f34fa3d0329642615c17061e252c6afe

• 051517b5b685116c2f4f1e6b535eb4cb

• da05d6ab72290ca064916324cbc86bab

• 443a00feeb3beaea02b2fbcd4302a3c9

• f6d72abf9ca654a20bbaf23ea1c10a55

SHA256 Hashes

• eb9ab1de159d7bf96af0fe0c6e6e1acd120b76d339b8f8acd38b2e3279c21f5f

• 06a297eb80274e0821516cb1b0025a231c5b63ae5ab30b84b2d10f6350d4f484

• 863295b41441bfe25b970f1f89768fad33826f5e3c379cea595c174ad37244f9

• f69e102fa65174b2c4821003bde36af264f8ef73bc7ca2ce0d97c43ee3e9e21a

• d8d86b15e68889bf76b3cf8e335f43afe0287b9b20aeb18b136b90a516695989

• ccb6ca4cb385db50dad2e3b7c68a90ddee62398edb0fd41afdb793287cfbe8e6

• 90bf1f20f962d04f8ae3f936d0f9046da28a75fa2fb37f267ff0453f272c60a0

Filenames

• aio02.dat, aio03.bat, aio01.dat, tony31.dat, tony32.dat, tony33.bat

• *.zip, *.lnk

MITRE ATT&CK TTPs

• Initial Access: T1566 (Phishing), T1566.001 (Spearphishing Attachment)

• Execution: T1059 (Command and Scripting Interpreter), T1059.001 (PowerShell), T1204.001 (Malicious Link), T1204.002 (Malicious File)

• Persistence & Privilege Escalation: T1547.001 (Registry Run Keys/Startup Folder), T1574.001 (DLL Hijacking)

• Defense Evasion: T1055.001 (DLL Injection), T1055.009 (Proc Memory), T1027 (Obfuscated Files), T1070.004 (File Deletion)

• Discovery & Collection: T1083 (File Discovery), T1082 (System Information), T1113 (Screen Capture), T1123 (Audio Capture)

• Exfiltration & C2: T1102.002 (Web Service – Bidirectional Communication), T1041 (Exfiltration over C2 Channel)

References

• Hive Pro Threat Advisory – RokRAT Resurfaces: APT37’s Fileless Shortcut to Espionage

• Seqrite Blog – Operation HanKook Phantom: North Korean APT37 Targeting South Korea