NarwhalRAT: APT37-Linked Python RAT Deployed via Fake Microsoft OTP-Abuse Alerts Against South Korean Targets

NarwhalRAT: APT37-Linked Python RAT Deployed via Fake (TL-2026-1525), also tracked as NarwhalRAT, is a high-severity malware campaign, first published 2026-06-15. It is attributed to APT37 (North Korea) with high confidence, affects Microsoft Windows (endpoint/desktop), maps to 24 MITRE ATT&CK techniques (T1005, T1010, T1020), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-1525

Threat ID
TL-2026-1525
Also known as
NarwhalRAT
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-15
Last reviewed
2026-06-15
Attribution
APT37
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
ESPIONAGE
Target sectors
government administration, news - media, civil society, defectors-and-ngo, individuals
Target regions
south korea
Detection rules
9
Indicators of compromise
30

Malware and tooling in NarwhalRAT: APT37-Linked Python RAT Deployed via Fake

Malware and tooling: NarwhalRAT, pCloud API

Genians Security Center identified NarwhalRAT, a Python-based Remote Access Trojan deployed by the North Korean APT37 (ScarCruft) group via spear-phishing emails spoofing Microsoft Account Team OTP-abuse security alerts. Delivery uses a multi-stage LNK-to-PowerShell-to-Batch-to-Python infection chain culminating in fileless, in-memory PE execution via Python ctypes, with dual-channel C2 (Korean relay websites plus the pCloud API as a dead-drop resolver) and extensive collection capability (keylogging, screen capture, microphone recording, USB harvesting).

How NarwhalRAT: APT37-Linked Python RAT Deployed via Fake works

NarwhalRAT represents a documented diversification of APT37's malware arsenal away from its signature RokRAT tooling toward a fully Python-based remote access trojan. The infection begins with a ZIP archive containing a malicious LNK file disguised as a security advisory; the LNK abuses cmd.exe environment-variable substring substitution (`%variable:~position,1%`) to obfuscate a PowerShell command launched with `-ExecutionPolicy Bypass`. PowerShell uses a copied curl.exe binary to fetch a batch script; a path-concatenation bug (`$env:TEMP+'uARKK20.exe'`, missing a path separator) is visible in the loader chain. The batch script, KHjWFcsE.bat, reconstructs further commands via environment-variable substitution and downloads a legitimate Python 3.10.0 embeddable interpreter from official python.org infrastructure, extracting it to C:\Users\Public\AccountPictures\UserInerfacePicture and renaming pythonw.exe to userscreen.exe — a masquerade technique. It then fetches config.cat, a Python .pyc bytecode file disguised with a Windows-catalog-file extension (magic bytes 6F 0D 0D 0A), which connects to the webhostingkorea[.]com C2 relay to retrieve further batch commands and the final payload, AccountConfig.cat (~7.5MB, containing over 33,000 lines of obfuscated Python source). AccountConfig.cat decrypts a Base64-encoded blob using a SHA-256 KDF seeded with the hardcoded string 'aHAnLLtQrP8Ce', XORs the result into a raw PE image, then uses Python ctypes to call VirtualAlloc with PAGE_EXECUTE_READWRITE, copies the PE into the allocated region via RtlMoveMemory, and invokes it through a CFUNCTYPE cast — achieving fully fileless, in-process execution with no PE ever touching disk. Before executing, the malware performs anti-VM checks via CPUID Hypervisor Vendor ID inspection for 'VMwareVMware', 'VBoxVBoxVBox', and the endianness-shifted Parallels string ' lrpepyh vr', exiting with code 3 if virtualization is detected. Persistence is established via a Scheduled Task named 'MicrosoftUserInterfacePicturesUpdateTackMachine' that re-invokes userscreen.exe against config.cat every minute. A working directory at %APPDATA% averwhale (Hidden+System attributes) masquerades as the Naver Whale browser, and a randomly-named .ent configuration file under %LOCALAPPDATA%\Microsoft\Internet Explorer stores AES-128-encrypted operator settings (C2 addresses, communication password, feature flags) derived via CryptDeriveKey() from the hardcoded string '!221aeAescde##2aefseseppl^12'. Command and control is dual-channel: primary communication runs through a set of Korean-hosted relay websites/IPs, while the pCloud cloud-storage API (folderid/auth parameters) acts as an auxiliary dead-drop resolver that operators update to rotate live C2 addresses without needing to touch already-deployed implants. The malware supports over 30 operator command prefixes covering keylogging (with active-window tracking via GetForegroundWindow/GetWindowTextA/GetWindowThreadProcessId, filtering out KakaoTalk and IME-related windows), screen capture (standard and high-quality variants), microphone/audio recording, USB-drive harvesting via generated xcopy commands, arbitrary remote command execution, file upload/download, remote mouse clicking, and live reconfiguration of C2 servers and the communication password. The phishing lure — subject '[Urgent] Security Check Notice Regarding Repeated One-Time Password (OTP) Generation', spoofing 'Microsoft Account Team' — drops a decoy HWP document, 'Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).hwp', that shares identical 'Last Saved By: Lailey' metadata and reused body structure with a decoy document ('Cybercrime Reporting System (ECRM).hwp') from an earlier, disclosed APT37 case. Genians attributes NarwhalRAT to APT37 with high confidence based on near-identical LNK obfuscation patterns (Link Flags, Extra Blocks, Argument Shape), matching BAT/curl.exe naming methodology, .pyc-as-.cat disguising, identical Scheduled Task persistence technique, the pCloud dead-drop auxiliary channel, and Korean-specific social-engineering conventions (HWP lures, KakaoTalk filtering, Naver Whale directory naming) shared with a May/September 2025 APT37 Python backdoor campaign and a related May 2026 AI-deepfake-themed Python backdoor campaign that reused French (.fr) C2 infrastructure and cafe24[.]com email services across both waves. The final payload's PE compile timestamp (2026-04-30 18:07:49 KST, evening hours) suggests continued operator testing shortly before the observed campaign.

MITRE ATT&CK techniques used in TL-2026-1525

Collection

T1005 Data from Local System; T1025 Data from Removable Media; T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture

Discovery

T1010 Application Window Discovery; T1083 File and Directory Discovery

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution

Persistence

T1053 Scheduled Task/Job

Credential Access

T1056 Input Capture

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1573 Encrypted Channel

Initial Access

T1566 Phishing

Affected products and versions in NarwhalRAT: APT37-Linked Python RAT Deployed via Fake

  • Microsoft — Windows (endpoint/desktop)
    Vulnerable versions: all supported Windows desktop versions targeted by social engineering, no vulnerable-version dependency

Remediation for NarwhalRAT: APT37-Linked Python RAT Deployed via Fake

Immediate actions

  • Block outbound network traffic to the identified Korean relay domains and IPs (daehoat[.]com, novel21.co[.]kr, webhostingkorea[.]com, crwellfood[.]com, fe01.co[.]kr, 121.254.222.10, 121.254.222.80, 211.239.157.126, 218.150.78.198, 218.150.78.231, 61.100.9.206)
  • Block or monitor pCloud API traffic (api.pcloud.com) from endpoint segments where no legitimate business use exists
  • Hunt for the Scheduled Task 'MicrosoftUserInterfacePicturesUpdateTackMachine' and the mutex 'i5zJH9FL10cVd3sSW9eyWWErPJ' across the endpoint fleet
  • Hunt for %APPDATA%\naverwhale and %LOCALAPPDATA%\Microsoft\Internet Explorer\*.ent artifacts
  • Quarantine and block the four disclosed MD5 hashes at the EDR/AV layer
  • Alert on renamed pythonw.exe executables (e.g., userscreen.exe) invoked with a .cat argument

Workarounds

  • Disable LNK execution from ZIP-extracted paths via Attack Surface Reduction rules (block execution of files from removable/downloaded archive locations)
  • Restrict PowerShell execution policy and log/alert on '-ExecutionPolicy Bypass' invocations spawned from cmd.exe /k

Longer-term hardening

  • Deploy EDR behavioral detection for anti-VM CPUID checks combined with subsequent VirtualAlloc(PAGE_EXECUTE_READWRITE) + RtlMoveMemory patterns from python.exe/pythonw.exe processes
  • Restrict execution of embeddable/portable Python interpreters downloaded outside approved software channels
  • User-awareness training on Microsoft-branded OTP/security-alert phishing lures, especially HWP-format decoy attachments
  • Implement application allow-listing to prevent Scheduled Task creation pointing at binaries in non-standard user-writable directories

Timeline of NarwhalRAT: APT37-Linked Python RAT Deployed via Fake

  • A Python loader module tied to APT37's Rust/Python toolkit lineage (later documented by Zscaler ThreatLabz) is compiled with an embedded creation timestamp of 2025-04-01 05:42:03, predating and structurally foreshadowing NarwhalRAT's Python-loader design.
  • Rustonotto, APT37's first known Rust-compiled Windows backdoor, becomes active in the wild (per Zscaler ThreatLabz), marking the start of the actor's toolkit-diversification push that continues through NarwhalRAT's Python-based design.
  • Zscaler ThreatLabz publishes 'APT37 Targets Windows with Rust Backdoor and Python Loader,' documenting the Rustonotto Rust backdoor and an associated Python loader that establish APT37's pre-NarwhalRAT multi-language tooling shift.
  • Genians publishes an earlier APT37 AI-deepfake-impersonation Python backdoor campaign report, establishing the baseline batch/Python-loader TTPs later reused in NarwhalRAT.
  • NarwhalRAT's final PE payload is compiled (PE timestamp 2026-04-30 18:07:49 KST, evening hours), indicating active operator testing shortly before deployment.
  • Genians publishes 'Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign,' documenting a related APT37 Python-backdoor wave sharing cafe24[.]com email infrastructure and .fr C2 domains with the 2025 case, reinforcing the actor's operational continuity ahead of NarwhalRAT.
  • Genians Security Center publishes 'Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2,' disclosing the NarwhalRAT campaign, its infection chain, C2 infrastructure, and file hashes.
  • The Hacker News and GBHackers publish independent coverage amplifying the NarwhalRAT findings, confirming attribution to APT37/ScarCruft and the pCloud dead-drop resilience mechanism.

Sources cited for NarwhalRAT: APT37-Linked Python RAT Deployed via Fake

Threats related to NarwhalRAT: APT37-Linked Python RAT Deployed via Fake

Detection coverage for TL-2026-1525

As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1525 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats