ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake Microsoft Account Security Alerts and LNK-in-ZIP Staging with pCloud Dead-Drop C2

ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake (TL-2026-0890), also tracked as NarwhalRAT campaign, is a high-severity malware campaign, first published 2026-06-20. It is attributed to APT37 (North Korea) with high confidence, affects Microsoft Windows, maps to 28 MITRE ATT&CK techniques (T1010, T1025, T1027), and is covered by 9 detection rules and 32 indicators of compromise.

Key facts for TL-2026-0890

Threat ID
TL-2026-0890
Also known as
NarwhalRAT campaign, Fake Microsoft OTP Alert campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-20
Last reviewed
2026-06-20
Attribution
APT37
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
ESPIONAGE
Target sectors
government, defense, academia, non-profit, media
Target regions
South Korea, East Asia
Detection rules
9
Indicators of compromise
32

Malware and tooling in ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake

Malware and tooling: NarwhalRAT

North Korean state-sponsored group ScarCruft (APT37) is running a spear-phishing campaign impersonating Microsoft Account security/OTP-abuse notifications to deliver NarwhalRAT, a new Python-based remote access trojan. The lure delivers a ZIP containing a malicious LNK that runs intermediary batch scripts to stage embedded-Python, decrypt compiled bytecode, and execute the RAT in memory, with compromised Korean websites and the pCloud cloud API used as a dead-drop C2 resolver.

How ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake works

Genians Security Center attributes a June 2026 spear-phishing campaign to the North Korean state-sponsored actor ScarCruft (APT37) that deploys a previously unseen Python-based remote access trojan named NarwhalRAT. The lure email impersonates a Microsoft Account security team notification (subject themed '[Urgent] Security Check Notice Regarding Repeated One-Time Password (OTP) Generation') designed to alarm the recipient about account compromise and OTP abuse, inducing execution of the attached archive. The attachment is a ZIP ('Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).zip') containing a malicious Windows shortcut (LNK) disguised as a security advisory rather than the HWP documents historically favored by the group.

When launched, the LNK initiates a multi-stage infection chain driven by intermediary obfuscated batch scripts (e.g., KHjWFcsE.bat) that abuse living-off-the-land binaries curl.exe and tar.exe, plus PowerShell with execution-policy bypass, to download a legitimate embedded Python 3.10.0 distribution from the official source, a decoy HWP document, the malicious payload, and a Windows security catalog (.cat) file. The batch layer hides strings via CMD environment-variable substring substitution. Persistence is established through a scheduled task ('MicrosoftUserInterfacePicturesUpdateTackMachine', earlier variant 'MicrosoftMusicLibrariesPackageTaskMachine') that runs every minute and launches a renamed Pythonw.exe (userscreen.exe), which decrypts and runs the main NarwhalRAT payload (Python compiled bytecode disguised as config.cat / AccountConfig.cat) entirely in memory via ctypes with RWX allocation.

NarwhalRAT establishes a hidden, system-attributed working directory at %APPDATA% averwhale (masquerading as the Naver Whale browser) and uses a single-instance mutex (i5zJH9FL10cVd3sSW9eyWWErPJ). Its configuration is stored locally as an AES-128-encrypted .ent file under the Internet Explorer profile, with a custom key-derivation scheme combining a hardcoded seed string, salt, and a 4-byte big-endian counter run through repeated SHA-256 hashing to produce an XOR keystream. The RAT exposes more than 30 command prefixes for keylogging, high-resolution screen capture, ambient microphone/audio recording, USB/removable-media collection (via xcopy), directory listing, active-window telemetry, remote command execution, and dynamic C2 server switching. Its keylogging loop explicitly filters out KakaoTalk and system UI window classes to keep captured data clean. The malware performs anti-VM CPUID hypervisor checks (VMware, VirtualBox, Parallels) and heavy string obfuscation (chr() reconstruction, reversed strings, indirect __import__).

For command and control, NarwhalRAT uses compromised legitimate Korean websites (daehoat.com, novel21.co.kr) as primary relays, with default endpoints embedded in the bytecode, and implements a secondary dead-drop resolver over the legitimate pCloud cloud-storage API using 'folderid' and 'auth' parameters. The deployment of NarwhalRAT is notable as a departure from RokRAT, the malware family previously exclusive to ScarCruft, indicating an evolution in the group's tooling. Targeting is focused primarily on South Korean users.

MITRE ATT&CK techniques used in TL-2026-0890

Discovery

T1010 Application Window Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1120 Peripheral Device Discovery

Collection

T1025 Data from Removable Media; T1056 Input Capture; T1074 Data Staged; T1113 Screen Capture; T1123 Audio Capture

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution

Persistence

T1053 Scheduled Task/Job

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel

command-and-control

T1105 Ingress Tool Transfer

Initial Access

T1566 Phishing

Resource Development

T1584 Compromise Infrastructure; T1587 Develop Capabilities

Affected products and versions in ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake

  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11

Remediation for ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake

Immediate actions

  • Block the C2 domains daehoat.com, novel21.co.kr, crwellfood.com, fe01.co.kr, and webhostingkorea.com and the listed IPs at perimeter and DNS resolvers
  • Quarantine emails impersonating Microsoft Account / OTP security notices that carry ZIP attachments containing LNK files
  • Hunt for the scheduled tasks 'MicrosoftUserInterfacePicturesUpdateTackMachine' and 'MicrosoftMusicLibrariesPackageTaskMachine' and remove them
  • Search for the working directory %APPDATA%\naverwhale and files config.cat / AccountConfig.cat / userscreen.exe

Workarounds

  • Block execution of .lnk files from the Downloads and temp/extracted-archive paths via WDAC/AppLocker
  • Configure mark-of-the-web enforcement so archive-extracted LNK/scripts are blocked or warned

Longer-term hardening

  • Deploy EDR with behavioral detection for embedded-Python execution and in-memory bytecode loading via ctypes
  • Restrict and monitor curl.exe, tar.exe, and powershell.exe execution from user-writable paths
  • Implement egress monitoring/blocking for anomalous pCloud API (api.pcloud.com) usage acting as dead-drop C2
  • Disable or alert on LNK files executing batch/PowerShell from email-derived archives

Timeline of ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake

  • Genians previously disclosed a related ScarCruft Python-based backdoor case sharing techniques (ZIP+LNK staging, embedded-Python, scheduled-task persistence) with the later NarwhalRAT chain, establishing a continuity of tooling.
  • NarwhalRAT loader PE compiled with timestamp 2026-04-30 18:07:49 KST; the build occurred in evening (non-business) hours, consistent with the operator's local working pattern.
  • Active in-the-wild spear-phishing campaign begins distributing emails impersonating Microsoft Account OTP-abuse security alerts ('[Urgent] Security Check Notice Regarding Repeated One-Time Password (OTP) Generation') carrying the malicious ZIP/LNK against South Korean users.
  • Compromised legitimate Korean websites (daehoat.com, novel21.co.kr) and the pCloud API are observed serving as primary relay C2 and secondary dead-drop resolver respectively, with embedded default member.php/index.php endpoints.
  • CyberPress publishes corroborating coverage of the Microsoft Account security-alert lure delivering NarwhalRAT.
  • Genians Security Center (GSC) publishes the technical analysis 'Analysis of APT37 NarwhalRAT' detailing the MS-themed phishing chain, in-memory Python execution, and pCloud dead-drop C2.
  • Reporting attributes the campaign to ScarCruft/APT37 with high confidence based on TTP overlap, Korean targeting, and infrastructure reuse, and flags NarwhalRAT as a new Python-based family in the group's arsenal.
  • The Hacker News, GBHackers, CyberSecurityNews and SC Media report the campaign, confirming the departure from RokRAT (ScarCruft's historic exclusive RAT) and the abuse of pCloud as dead-drop C2.
  • Threat documented and operationalized in the Threadlinqs Intelligence Platform with full IOC extraction and MITRE ATT&CK mapping.

Sources cited for ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake

Threats related to ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake

Detection coverage for TL-2026-0890

As of 2026-06-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0890 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats