NarwhalRAT: APT37-Linked Python RAT Deployed via Fake Microsoft OTP-Abuse Alerts Against South Korean Targets — Threadlinqs Intelligence
As of 2026-06-15, NarwhalRAT: APT37-Linked Python RAT Deployed via Fake Microsoft OTP-Abuse Alerts Against South Korean Targets is a high-severity malware threat attributed to APT37 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1525 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: APT37 · North Korea · ESPIONAGE
Genians Security Center identified NarwhalRAT, a Python-based Remote Access Trojan deployed by the North Korean APT37 (ScarCruft) group via spear-phishing emails spoofing Microsoft Account Team
NarwhalRAT represents a documented diversification of APT37's malware arsenal away from its signature RokRAT tooling toward a fully Python-based remote access trojan. The infection begins with a ZIP archive containing a malicious LNK file disguised as a security advisory; the LNK abuses cmd.exe environment-variable substring substitution (`%variable:~position,1%`) to obfuscate a PowerShell command launched with `-ExecutionPolicy Bypass`. PowerShell uses a copied curl.exe binary to fetch a batch script; a path-concatenation bug (`$env:TEMP+'uARKK20.exe'`, missing a path separator) is visible in the loader chain. The batch script, KHjWFcsE.bat, reconstructs further commands via environment-variable substitution and downloads a legitimate Python 3.10.0 embeddable interpreter from official python.org infrastructure, extracting it to C:\Users\Public\AccountPictures\UserInerfacePicture and renaming pythonw.exe to userscreen.exe — a masquerade technique. It then fetches config.cat, a Python .pyc bytecode file disguised with a Windows-catalog-file extension (magic bytes 6F 0D 0D 0A), which connects to the webhostingkorea[.]com C2 relay to retrieve further batch commands and the final payload, AccountConfig.cat (~7.5MB, containing over 33,000 lines of obfuscated Python source). AccountConfig.cat decrypts a Base64-encoded blob using a SHA-256 KDF seeded with the hardcoded string 'aHAnLLtQrP8Ce', XORs the result into a raw PE image, then uses Python ctypes to call VirtualAlloc with PAGE_EXECUTE_READWRITE, copies the PE into the allocated region via RtlMoveMemory, and invokes it through a CFUNCTYPE cast — achieving fully fileless, in-process execution with no PE ever touching disk. Before executing, the malware performs anti-VM checks via CPUID Hypervisor Vendor ID inspection for 'VMwareVMware', 'VBoxVBoxVBox', and the endianness-shifted Parallels string ' lrpepyh vr', exiting with code 3 if virtualization is detected. Persistence is established via a Scheduled Task named 'MicrosoftUserInterfacePicturesUpdateTackMachine' that re-invokes userscreen.exe against config.cat every minute. A working directory at %APPDATA%
averwhale (Hidden+System attributes) masquerades as the Naver Whale browser, and a randomly-named .ent configuration file under %LOCALAPPDATA%\Microsoft\Internet Explorer stores AES-128-encrypted operator settings (C2 addresses, communication password, feature flags) derived via CryptDeriveKey() from the hardcoded string '!221aeAescde##2aefseseppl^12'. Command and control is dual-channel: primary communication runs through a set of Korean-hosted relay websites/IPs, while the pCloud cloud-storage API (folderid/auth parameters) acts as an auxiliary dead-drop resolver that operators update to rotate live C2 addresses without needing to touch already-deployed implants. The malware supports over 30 operator command prefixes covering keylogging (with active-window tracking via GetForegroundWindow/GetWindowTextA/GetWindowThreadProcessId, filtering out KakaoTalk and IME-related windows), screen capture (standard and high-quality variants), microphone/audio recording, USB-drive harvesting via generated xcopy commands, arbitrary remote command execution, file upload/download, remote mouse clicking, and live reconfiguration of C2 servers and the communication password. The phishing lure — subject '[Urgent] Security Check Notice Regarding Repeated One-Time Password (OTP) Generation', spoofing 'Microsoft Account Team' — drops a decoy HWP document, 'Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).hwp', that shares identical 'Last Saved By: Lailey' metadata and reused body structure with a decoy document ('Cybercrime Reporting System (ECRM).hwp') from an earlier, disclosed APT37 case. Genians attributes NarwhalRAT to APT37 with high confidence based on near-identical LNK obfuscation patterns (Link Flags, Extra Blocks, Argument Shape), matching BAT/curl.exe naming methodology, .pyc-as-.cat disguising, identical Scheduled Tas
Target sectors: government administration, news - media, civil society, defectors-and-ngo, individuals
Target regions: south korea
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566, T1204, T1059, T1059, T1059, T1053, T1053, T1036, T1140