# NarwhalRAT: APT37-Linked Python RAT Deployed via Fake Microsoft OTP-Abuse Alerts Against South Korean Targets

> Genians Security Center identified NarwhalRAT, a Python-based Remote Access Trojan deployed by the North Korean APT37 (ScarCruft) group via spear-phishing emails spoofing Microsoft Account Team OTP-abuse security alerts. Delivery uses a multi-stage LNK-to-PowerShell-to-Batch-to-Python infection chain culminating in fileless, in-memory PE execution via Python ctypes, with dual-channel C2 (Korean relay websites plus the pCloud API as a dead-drop resolver) and extensive collection capability (keylogging, screen capture, microphone recording, USB harvesting).

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1525
- **ID:** TL-2026-1525
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT37 (North Korea)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

NarwhalRAT represents a documented diversification of APT37's malware arsenal away from its signature RokRAT tooling toward a fully Python-based remote access trojan. The infection begins with a ZIP archive containing a malicious LNK file disguised as a security advisory; the LNK abuses cmd.exe environment-variable substring substitution (`%variable:~position,1%`) to obfuscate a PowerShell command launched with `-ExecutionPolicy Bypass`. PowerShell uses a copied curl.exe binary to fetch a batch script; a path-concatenation bug (`$env:TEMP+'uARKK20.exe'`, missing a path separator) is visible in the loader chain. The batch script, KHjWFcsE.bat, reconstructs further commands via environment-variable substitution and downloads a legitimate Python 3.10.0 embeddable interpreter from official python.org infrastructure, extracting it to C:\Users\Public\AccountPictures\UserInerfacePicture and renaming pythonw.exe to userscreen.exe — a masquerade technique. It then fetches config.cat, a Python .pyc bytecode file disguised with a Windows-catalog-file extension (magic bytes 6F 0D 0D 0A), which connects to the webhostingkorea[.]com C2 relay to retrieve further batch commands and the final payload, AccountConfig.cat (~7.5MB, containing over 33,000 lines of obfuscated Python source). AccountConfig.cat decrypts a Base64-encoded blob using a SHA-256 KDF seeded with the hardcoded string 'aHAnLLtQrP8Ce', XORs the result into a raw PE image, then uses Python ctypes to call VirtualAlloc with PAGE_EXECUTE_READWRITE, copies the PE into the allocated region via RtlMoveMemory, and invokes it through a CFUNCTYPE cast — achieving fully fileless, in-process execution with no PE ever touching disk. Before executing, the malware performs anti-VM checks via CPUID Hypervisor Vendor ID inspection for 'VMwareVMware', 'VBoxVBoxVBox', and the endianness-shifted Parallels string ' lrpepyh vr', exiting with code 3 if virtualization is detected. Persistence is established via a Scheduled Task named 'MicrosoftUserInterfacePicturesUpdateTackMachine' that re-invokes userscreen.exe against config.cat every minute. A working directory at %APPDATA%
averwhale (Hidden+System attributes) masquerades as the Naver Whale browser, and a randomly-named .ent configuration file under %LOCALAPPDATA%\Microsoft\Internet Explorer stores AES-128-encrypted operator settings (C2 addresses, communication password, feature flags) derived via CryptDeriveKey() from the hardcoded string '!221aeAescde##2aefseseppl^12'. Command and control is dual-channel: primary communication runs through a set of Korean-hosted relay websites/IPs, while the pCloud cloud-storage API (folderid/auth parameters) acts as an auxiliary dead-drop resolver that operators update to rotate live C2 addresses without needing to touch already-deployed implants. The malware supports over 30 operator command prefixes covering keylogging (with active-window tracking via GetForegroundWindow/GetWindowTextA/GetWindowThreadProcessId, filtering out KakaoTalk and IME-related windows), screen capture (standard and high-quality variants), microphone/audio recording, USB-drive harvesting via generated xcopy commands, arbitrary remote command execution, file upload/download, remote mouse clicking, and live reconfiguration of C2 servers and the communication password. The phishing lure — subject '[Urgent] Security Check Notice Regarding Repeated One-Time Password (OTP) Generation', spoofing 'Microsoft Account Team' — drops a decoy HWP document, 'Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).hwp', that shares identical 'Last Saved By: Lailey' metadata and reused body structure with a decoy document ('Cybercrime Reporting System (ECRM).hwp') from an earlier, disclosed APT37 case. Genians attributes NarwhalRAT to APT37 with high confidence based on near-identical LNK obfuscation patterns (Link Flags, Extra Blocks, Argument Shape), matching BAT/curl.exe naming methodology, .pyc-as-.cat disguising, identical Scheduled Task persistence technique, the pCloud dead-drop auxiliary channel, and Korean-specific social-engineering conventions (HWP lures, KakaoTalk filtering, Naver Whale directory naming) shared with a May/September 2025 APT37 Python backdoor campaign and a related May 2026 AI-deepfake-themed Python backdoor campaign that reused French (.fr) C2 infrastructure and cafe24[.]com email services across both waves. The final payload's PE compile timestamp (2026-04-30 18:07:49 KST, evening hours) suggests continued operator testing shortly before the observed campaign.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1053 Scheduled Task/Job
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1620 Reflective Code Loading
- T1564 Hide Artifacts
- T1056 Input Capture
- T1010 Application Window Discovery
- T1083 File and Directory Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1025 Data from Removable Media
- T1005 Data from Local System
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1020 Automated Exfiltration
- T1041 Exfiltration Over C2 Channel

## Sources

- [Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2](https://www.genians.co.kr/en/blog/threat_intelligence/narwhalrat)
- [Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign](https://www.genians.co.kr/en/blog/threat_intelligence/python)
- [Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware](https://thehackernews.com/2026/06/fake-microsoft-alerts-used-to-deploy.html)
- [APT37 Hackers Use NarwhalRAT Malware With MS-Themed Phishing and Dead-Drop C2](https://gbhackers.com/apt37-hackers-use-narwhalrat-malware/)
- [APT37, InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima (G0067)](https://attack.mitre.org/groups/G0067/)
- [APT37 (Threat Actor) Profile](https://malpedia.caad.fkie.fraunhofer.de/actor/apt37)
- [Dark Web Profile: ScarCruft / APT37](https://socradar.io/blog/threat-actor-profile-scarcruft-apt37/)
- [APT37 Targets Windows with Rust Backdoor and Python Loader](https://www.zscaler.com/blogs/security-research/apt37-targets-windows-rust-backdoor-and-python-loader)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1525