# ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake Microsoft Account Security Alerts and LNK-in-ZIP Staging with pCloud Dead-Drop C2

> North Korean state-sponsored group ScarCruft (APT37) is running a spear-phishing campaign impersonating Microsoft Account security/OTP-abuse notifications to deliver NarwhalRAT, a new Python-based remote access trojan. The lure delivers a ZIP containing a malicious LNK that runs intermediary batch scripts to stage embedded-Python, decrypt compiled bytecode, and execute the RAT in memory, with compromised Korean websites and the pCloud cloud API used as a dead-drop C2 resolver.

- **Published:** 2026-06-20T00:00:00Z
- **Last reviewed:** 2026-06-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0890
- **ID:** TL-2026-0890
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT37 (North Korea)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Genians Security Center attributes a June 2026 spear-phishing campaign to the North Korean state-sponsored actor ScarCruft (APT37) that deploys a previously unseen Python-based remote access trojan named NarwhalRAT. The lure email impersonates a Microsoft Account security team notification (subject themed '[Urgent] Security Check Notice Regarding Repeated One-Time Password (OTP) Generation') designed to alarm the recipient about account compromise and OTP abuse, inducing execution of the attached archive. The attachment is a ZIP ('Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).zip') containing a malicious Windows shortcut (LNK) disguised as a security advisory rather than the HWP documents historically favored by the group.

When launched, the LNK initiates a multi-stage infection chain driven by intermediary obfuscated batch scripts (e.g., KHjWFcsE.bat) that abuse living-off-the-land binaries curl.exe and tar.exe, plus PowerShell with execution-policy bypass, to download a legitimate embedded Python 3.10.0 distribution from the official source, a decoy HWP document, the malicious payload, and a Windows security catalog (.cat) file. The batch layer hides strings via CMD environment-variable substring substitution. Persistence is established through a scheduled task ('MicrosoftUserInterfacePicturesUpdateTackMachine', earlier variant 'MicrosoftMusicLibrariesPackageTaskMachine') that runs every minute and launches a renamed Pythonw.exe (userscreen.exe), which decrypts and runs the main NarwhalRAT payload (Python compiled bytecode disguised as config.cat / AccountConfig.cat) entirely in memory via ctypes with RWX allocation.

NarwhalRAT establishes a hidden, system-attributed working directory at %APPDATA%\naverwhale (masquerading as the Naver Whale browser) and uses a single-instance mutex (i5zJH9FL10cVd3sSW9eyWWErPJ). Its configuration is stored locally as an AES-128-encrypted .ent file under the Internet Explorer profile, with a custom key-derivation scheme combining a hardcoded seed string, salt, and a 4-byte big-endian counter run through repeated SHA-256 hashing to produce an XOR keystream. The RAT exposes more than 30 command prefixes for keylogging, high-resolution screen capture, ambient microphone/audio recording, USB/removable-media collection (via xcopy), directory listing, active-window telemetry, remote command execution, and dynamic C2 server switching. Its keylogging loop explicitly filters out KakaoTalk and system UI window classes to keep captured data clean. The malware performs anti-VM CPUID hypervisor checks (VMware, VirtualBox, Parallels) and heavy string obfuscation (chr() reconstruction, reversed strings, indirect __import__).

For command and control, NarwhalRAT uses compromised legitimate Korean websites (daehoat.com, novel21.co.kr) as primary relays, with default endpoints embedded in the bytecode, and implements a secondary dead-drop resolver over the legitimate pCloud cloud-storage API using 'folderid' and 'auth' parameters. The deployment of NarwhalRAT is notable as a departure from RokRAT, the malware family previously exclusive to ScarCruft, indicating an evolution in the group's tooling. Targeting is focused primarily on South Korean users.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1053 Scheduled Task/Job
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1218 System Binary Proxy Execution
- T1105 Ingress Tool Transfer
- T1082 System Information Discovery
- T1120 Peripheral Device Discovery
- T1083 File and Directory Discovery
- T1010 Application Window Discovery
- T1056 Input Capture
- T1113 Screen Capture
- T1123 Audio Capture
- T1025 Data from Removable Media
- T1074 Data Staged
- T1102 Web Service
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2](https://www.genians.co.kr/en/blog/threat_intelligence/narwhalrat)
- [Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware](https://thehackernews.com/2026/06/fake-microsoft-alerts-used-to-deploy.html)
- [APT37 Hackers Use NarwhalRAT Malware With MS-Themed Phishing and Dead-Drop C2](https://gbhackers.com/apt37-hackers-use-narwhalrat-malware/)
- [Hackers Use Microsoft Account Security Alert Lures to Deliver NarwhalRAT Malware](https://cyberpress.org/microsoft-alert-spreads-narwhalrat/)
- [Hackers Abuse LNK Files, PowerShell, and Python Loader to Deploy NarwhalRAT](https://cybersecuritynews.com/powershell-and-python-loader-to-deploy-narwhalrat/)
- [North Korean hackers use fake Microsoft alerts to deploy NarwhalRAT malware](https://www.scworld.com/brief/north-korean-hackers-use-fake-microsoft-alerts-to-deploy-narwhalrat-malware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0890