Threat reportAPTTL-2026-0802
NarwhalRAT: APT37 Python-based RAT delivered via LNK/PowerShell/Python loader chain in Microsoft-themed Korean spear-phishing campaign
NarwhalRAT: APT37 Python-based RAT delivered via (TL-2026-0802), also tracked as NarwhalRAT, is a high-severity advanced persistent threat campaign, first published 2026-06-15. It is attributed to APT37 (North Korea) with high confidence, affects Microsoft Windows, maps to 28 MITRE ATT&CK techniques (T1005, T1010, T1025), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 28MITRE ATT&CK
- Actors
- 1APT37
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-0802
- Threat ID
- TL-2026-0802
- Also known as
- NarwhalRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- APT37
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, think tanks, media, human rights organizations, individuals of interest
- Target regions
- South Korea, East Asia
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in NarwhalRAT: APT37 Python-based RAT delivered via
Malware and tooling: NarwhalRAT
How NarwhalRAT: APT37 Python-based RAT delivered via works
Genians attributes NarwhalRAT, a heavily customized Python-based remote access trojan, to the North Korean state-sponsored group APT37. It is delivered through Microsoft Account Team-themed spear-phishing that lures Korean victims into opening a ZIP-borne LNK file, which chains through obfuscated PowerShell and an embedded Python loader. The RAT exposes 30+ command prefixes (keylogging, screen capture, microphone recording, USB/file exfiltration, remote execution) and uses a resilient dual C2 of Korean relay servers plus the legitimate pCloud API as a dead-drop resolver.
NarwhalRAT is an espionage-focused, Python-based remote access trojan that the Genians Security Center has attributed to the North Korean state-sponsored threat actor APT37 (ScarCruft / Reaper / Group123) based on massive technical overlap with prior APT37 operations, including an earlier 2026 deepfake/impersonation campaign and the actor's documented pattern of repurposing legitimate cloud services as multi-purpose C2.
Initial access is achieved via targeted spear-phishing emails impersonating the official "Microsoft Account Team," warning recipients of abnormal one-time-password (OTP) generation and urging them to review an attached security advisory. The attachment is a ZIP archive containing a malicious Windows shortcut disguised as the promised advisory (e.g., "Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).lnk"). The LNK's internal commands are heavily obfuscated using CMD environment-variable substring substitution, dynamically rebuilding strings such as "powershell" and "curl.exe" at runtime to evade static inspection.
Upon execution, the LNK launches PowerShell with a bypassed execution policy and uses a copied curl.exe to retrieve a decoy HWP document and a batch script (KHjWFcuS.bat) from Korean relay infrastructure (fe01[.]co[.]kr for the initial ZIP relay; webhostingkorea[.]com for the decoy/BAT and as C2). The batch stage downloads the official Python embedded package and renames pythonw.exe to usersscreen.exe to masquerade the Python runtime. Two payload files are dropped disguised as Windows catalog files: config.cat (compiled Python bytecode) and AccountConfig.cat (over 33,000 lines of obfuscated code carrying an embedded Base64 payload). Artifacts are staged under C:\Users\Public\AccountPictures\UserInerfacePicture\ and C:\ProgramData\GoogleDriveUpdateCheck\, and NarwhalRAT establishes the working directory 'naverwhale' (masquerading as the Naver Whale browser) — the source of the malware's name (an anagram play on 'Narwhal').
Persistence is established via a scheduled task named MicrosoftUserInterfacePicturesUpdateTackMachine that re-launches the loader at one-minute intervals. The RAT selectively activates more than 30 functions on demand: persistent keylogging (keystrokes are buffered and transmitted in batches), continuous screen capture, background microphone recording, file upload/download, collection of files from USB storage, remote command execution, and dynamic C2 reconfiguration. It performs application-window discovery to determine in real time which programs the victim is using, filtering collection to active windows while explicitly excluding background system processes and messenger applications such as KakaoTalk to reduce data noise. It also incorporates virtual-machine/sandbox detection to hamper analysis.
Command-and-control is dual-structured for resilience: primary Korean relay servers (daehoat[.]com, novel21[.]co[.]kr) carry interactive traffic, while the legitimate pCloud storage API is abused as a dead-drop resolver, hiding the actual server addresses within the cloud platform so operators can rotate C2 endpoints without modifying the deployed malware. Genians notes the broader APT37 tradecraft of abusing Dropbox, pCloud, Yandex, OneDrive, Google Drive, GitHub, Zoho Mail, Telegram, and Facebook as cloud-based C2/hosting/distribution channels. No CVE is associated; the campaign relies entirely on social engineering and living-off-the-land abuse of built-in tooling (PowerShell, curl.exe, the official Python runtime, and the Task Scheduler).
MITRE ATT&CK techniques used in TL-2026-0802
Collection
T1005 Data from Local System; T1025 Data from Removable Media; T1056 Input Capture; T1074 Data Staged; T1113 Screen Capture; T1119 Automated Collection; T1123 Audio Capture
Discovery
T1010 Application Window Discovery; T1057 Process Discovery; T1497 Virtualization/Sandbox Evasion
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
Persistence
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1573 Encrypted Channel
Initial Access
Resource Development
Affected products and versions in NarwhalRAT: APT37 Python-based RAT delivered via
- Microsoft — Windows
Vulnerable versions: Windows endpoints running PowerShell, curl.exe and Task Scheduler - Naver — Whale Browser (impersonated)
Vulnerable versions: Brand impersonated via 'naverwhale' working directory; no product vulnerability - Kakao — KakaoTalk (targeted for collection filtering)
Vulnerable versions: Window identifiers handled separately during data collection
Remediation for NarwhalRAT: APT37 Python-based RAT delivered via
Immediate actions
- Block the named relay/C2 domains at the perimeter and DNS layer: daehoat.com, novel21.co.kr, fe01.co.kr, webhostingkorea.com
- Hunt for the scheduled task 'MicrosoftUserInterfacePicturesUpdateTackMachine' and remove it on affected hosts
- Search endpoints for staging directories C:\Users\Public\AccountPictures\UserInerfacePicture\ and C:\ProgramData\GoogleDriveUpdateCheck\ and for a 'naverwhale' working directory
- Quarantine processes where pythonw.exe has been renamed (e.g., usersscreen.exe) and investigate abnormal memory usage from the Python runtime
Workarounds
- Block or restrict execution of .lnk files originating from email/ZIP archives
- Disable or tightly monitor PowerShell for standard users and enable script-block + module logging
- Restrict outbound access from curl.exe and PowerShell to known-good destinations
Longer-term hardening
- Deploy EDR policies that detect chained LNK -> PowerShell -> curl.exe -> Python execution and living-off-the-land abuse
- Alert on outbound connections to the pCloud API from non-sanctioned processes (dead-drop resolver abuse)
- Enforce least privilege and application control to prevent execution of embedded Python runtimes from user-writable paths
- Deliver phishing awareness training focused on Microsoft Account/OTP-themed lures and ZIP-borne LNK attachments
Timeline of NarwhalRAT: APT37 Python-based RAT delivered via
- A related Python-based backdoor campaign sharing tradecraft (dead-drop cloud C2, LNK delivery) is observed; later assessed as overlapping with the NarwhalRAT operation.
- CyberPress reports on the Microsoft Account/OTP security-alert lures delivering NarwhalRAT.
- Genians Security Center publishes analysis attributing NarwhalRAT to APT37, detailing the MS-themed phishing chain and pCloud dead-drop C2.
- Resilient dual C2 identified: Korean relay servers (daehoat[.]com, novel21[.]co[.]kr, fe01[.]co[.]kr, webhostingkorea[.]com) paired with the legitimate pCloud API abused as a dead-drop resolver for fallback C2.
- Genians Security Center observes active spear-phishing emails impersonating the Microsoft Account Team and delivering ZIP-borne malicious LNK attachments to Korean victims, triggering the LNK -> PowerShell -> Python loader chain.
- Campaign ingested into Threadlinqs Intelligence as TL-2026-0802 for detection coverage.
- Korean outlet Kyunghyang Shinmun reports the 'MS account team' phishing lure targeting Korean users.
- Cyber Security News publishes 'PowerShell and Python Loader to Deploy NarwhalRAT' detailing the LNK -> PowerShell -> Python loader chain and IOCs.
Sources cited for NarwhalRAT: APT37 Python-based RAT delivered via
- PowerShell and Python Loader to Deploy NarwhalRAT
- Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2 (Genians, mirrored)
- Hackers Use Microsoft Account Security Alert Lures to Deliver NarwhalRAT Malware
- Genians Threat Intelligence Center — Countering North Korean APTs
- 'This is the MS account team'... Clicking the attachment puts personal data into the hands of a hacker (Kyunghyang Shinmun)
- MITRE ATT&CK — APT37 (Group G0067)
Detection coverage for TL-2026-0802
As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0802 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.