# NarwhalRAT: APT37 Python-based RAT delivered via LNK/PowerShell/Python loader chain in Microsoft-themed Korean spear-phishing campaign

> Genians attributes NarwhalRAT, a heavily customized Python-based remote access trojan, to the North Korean state-sponsored group APT37. It is delivered through Microsoft Account Team-themed spear-phishing that lures Korean victims into opening a ZIP-borne LNK file, which chains through obfuscated PowerShell and an embedded Python loader. The RAT exposes 30+ command prefixes (keylogging, screen capture, microphone recording, USB/file exfiltration, remote execution) and uses a resilient dual C2 of Korean relay servers plus the legitimate pCloud API as a dead-drop resolver.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0802
- **ID:** TL-2026-0802
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT37 (North Korea)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

NarwhalRAT is an espionage-focused, Python-based remote access trojan that the Genians Security Center has attributed to the North Korean state-sponsored threat actor APT37 (ScarCruft / Reaper / Group123) based on massive technical overlap with prior APT37 operations, including an earlier 2026 deepfake/impersonation campaign and the actor's documented pattern of repurposing legitimate cloud services as multi-purpose C2.

Initial access is achieved via targeted spear-phishing emails impersonating the official "Microsoft Account Team," warning recipients of abnormal one-time-password (OTP) generation and urging them to review an attached security advisory. The attachment is a ZIP archive containing a malicious Windows shortcut disguised as the promised advisory (e.g., "Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).lnk"). The LNK's internal commands are heavily obfuscated using CMD environment-variable substring substitution, dynamically rebuilding strings such as "powershell" and "curl.exe" at runtime to evade static inspection.

Upon execution, the LNK launches PowerShell with a bypassed execution policy and uses a copied curl.exe to retrieve a decoy HWP document and a batch script (KHjWFcuS.bat) from Korean relay infrastructure (fe01[.]co[.]kr for the initial ZIP relay; webhostingkorea[.]com for the decoy/BAT and as C2). The batch stage downloads the official Python embedded package and renames pythonw.exe to usersscreen.exe to masquerade the Python runtime. Two payload files are dropped disguised as Windows catalog files: config.cat (compiled Python bytecode) and AccountConfig.cat (over 33,000 lines of obfuscated code carrying an embedded Base64 payload). Artifacts are staged under C:\Users\Public\AccountPictures\UserInerfacePicture\ and C:\ProgramData\GoogleDriveUpdateCheck\, and NarwhalRAT establishes the working directory 'naverwhale' (masquerading as the Naver Whale browser) — the source of the malware's name (an anagram play on 'Narwhal').

Persistence is established via a scheduled task named MicrosoftUserInterfacePicturesUpdateTackMachine that re-launches the loader at one-minute intervals. The RAT selectively activates more than 30 functions on demand: persistent keylogging (keystrokes are buffered and transmitted in batches), continuous screen capture, background microphone recording, file upload/download, collection of files from USB storage, remote command execution, and dynamic C2 reconfiguration. It performs application-window discovery to determine in real time which programs the victim is using, filtering collection to active windows while explicitly excluding background system processes and messenger applications such as KakaoTalk to reduce data noise. It also incorporates virtual-machine/sandbox detection to hamper analysis.

Command-and-control is dual-structured for resilience: primary Korean relay servers (daehoat[.]com, novel21[.]co[.]kr) carry interactive traffic, while the legitimate pCloud storage API is abused as a dead-drop resolver, hiding the actual server addresses within the cloud platform so operators can rotate C2 endpoints without modifying the deployed malware. Genians notes the broader APT37 tradecraft of abusing Dropbox, pCloud, Yandex, OneDrive, Google Drive, GitHub, Zoho Mail, Telegram, and Facebook as cloud-based C2/hosting/distribution channels. No CVE is associated; the campaign relies entirely on social engineering and living-off-the-land abuse of built-in tooling (PowerShell, curl.exe, the official Python runtime, and the Task Scheduler).

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1564 Hide Artifacts
- T1070 Indicator Removal
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1056 Input Capture
- T1113 Screen Capture
- T1123 Audio Capture
- T1025 Data from Removable Media
- T1005 Data from Local System
- T1119 Automated Collection
- T1074 Data Staged
- T1010 Application Window Discovery
- T1057 Process Discovery
- T1497 Virtualization/Sandbox Evasion
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities

## Sources

- [PowerShell and Python Loader to Deploy NarwhalRAT](https://cybersecuritynews.com/powershell-and-python-loader-to-deploy-narwhalrat/)
- [Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2 (Genians, mirrored)](https://malware.news/t/analysis-of-apt37-narwhalrat-leveraging-ms-themed-phishing-and-dead-drop-c2/107848)
- [Hackers Use Microsoft Account Security Alert Lures to Deliver NarwhalRAT Malware](https://cyberpress.org/microsoft-alert-spreads-narwhalrat/)
- [Genians Threat Intelligence Center — Countering North Korean APTs](https://www.genians.com/learn-more/insights/genians-threat-intelligence-report-countering-north-korean-apts-in-the-evolving-landscape/)
- ['This is the MS account team'... Clicking the attachment puts personal data into the hands of a hacker (Kyunghyang Shinmun)](https://www.khan.co.kr/en/article/202606151149047)
- [MITRE ATT&CK — APT37 (Group G0067)](https://attack.mitre.org/groups/G0067/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0802