Threat reportMalwareTL-2026-4944
APT37 NarwhalRAT: MS-Themed Phishing and pCloud Dead-drop C2 Targeting Korean Users
APT37 NarwhalRAT (TL-2026-4944), also tracked as NarwhalRAT, is a high-severity malware campaign, first published 2026-11-01. It is attributed to APT37 (North Korea) with medium confidence, affects Microsoft Windows, maps to 23 MITRE ATT&CK techniques (T1005, T1025, T1027), and is covered by 9 detection rules and 34 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 23MITRE ATT&CK
- Actors
- 1APT37
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 34Indicators of compromise
Key facts for TL-2026-4944
- Threat ID
- TL-2026-4944
- Also known as
- NarwhalRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- APT37
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, research, general-users
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in APT37 NarwhalRAT
Malware and tooling: NarwhalRAT
How APT37 NarwhalRAT works
Genians reports APT37 (ScarCruft) spear phishing impersonating the Microsoft Account Team to deliver a ZIP-packed malicious LNK that launches an obfuscated BAT/PowerShell chain deploying NarwhalRAT, a Python-based RAT. The RAT executes an encrypted PE in memory and uses a pCloud API dead-drop resolver plus compromised Korean relay servers for C2, with keylogging, screen capture, microphone recording, USB data collection, remote command execution and file transfer.
In June 2026 Genians Security Center published an analysis of a new APT37 campaign that distributes a compiled Python-based RAT it named NarwhalRAT (from the hard-coded 'naverwhale' working directory). Delivery starts with a spear-phishing email titled '[Urgent] Security Check Notice Regarding Repeated One-Time Password (OTP) Generation', sent as the 'Microsoft Account Team'. The ZIP 'Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).zip' is downloaded via a relay on fe01.co.kr and contains a LNK of the same name. The LNK hides its command line with CMD environment-variable substring substitution (variable a805aae), runs cmd.exe /k into PowerShell with -ExecutionPolicy Bypass, copies C:\Windows\System32\curl.exe to a non-standard path (uARKK20.exe) and downloads two files from webhostingkorea.com using 'contents' and 'board' parameters. A decoy HWP document with the same name is opened for the victim.
The second stage, KHjWFcsE.bat (obfuscated with variable a1373ro), downloads Python-3.10.0-embed-amd64.zip to C:\Users\Public\temp012.zip, extracts it to C:\Users\Public\AccountPictures\UserInerfacePicture, renames pythonw.exe to userscreen.exe and fetches config.cat, which is Python bytecode (magic 6F 0D 0D 0A) disguised as a Windows catalog file. Persistence is a scheduled task named MicrosoftUserInterfacePicturesUpdateTackMachine that runs userscreen.exe against config.cat at one-minute intervals.
config.cat uses chr() reconstruction, reversed strings ([::-1]) and getattr(__builtins__, '__import__') to hide strings. It downloads a second container, AccountConfig.cat (about 33,000 lines of obfuscated Python, stored under C:\ProgramData\GoogleDriveUpdateCheck), which it decrypts with a custom XOR scheme using a counter-based SHA-256 KDF (seed 'aHAnLLtQrP8Ce'). The result is a PE that is loaded fileless through Python ctypes (VirtualAlloc with PAGE_EXECUTE_READWRITE, RtlMoveMemory, CFUNCTYPE). The PE compile timestamp is 2026-04-30 18:07:49 KST. The malware checks CPUID hypervisor vendor strings for VMware, VirtualBox and Parallels, and uses mutex i5zJH9FL10cVd3sSW9eyWWErPJ. Its configuration is stored AES-128 encrypted (CryptoAPI, SHA-256 + CryptDeriveKey) in %LOCALAPPDATA%\Microsoft\Internet Explorer\<random>.ent.
C2 is dual-channel: HTTP relay scripts on compromised Korean sites (www.daehoat.com/wp-content/uploads/2017/02/member.php and www.novel21.co.kr/data/editor/2110/index.php) and the legitimate api.pcloud.com API, queried with folderid= and auth= parameters, as a dead-drop resolver for the live C2 address. The RAT supports 30+ command prefixes, including startscap:/endscap: (screen), startkcap:/endkcap: (keylog), startmicn:/endmicn: (microphone), usb2local: (USB copy via xcopy to C:\Users\Public\<random>), cmd:/cmdadm: (execution) and cmserver:/caserver:/cdserver:/chcommpwd: (reconfigure C2 servers and communication password). Collected data is staged in a hidden/system %APPDATA%\naverwhale folder and uploaded sequentially. Keylogging excludes KakaoTalk helper windows. Genians assesses the targets to be Korean users, citing the Naver Whale directory name, KakaoTalk filtering, HWP decoys and Korean-language lures.
Genians attributes the activity to APT37 based on shared C2 relays (fe01.co.kr, 211.239.157.126, 218.150.78.198) with its 2026-05-11 report on a Python backdoor campaign, identical decoy-document metadata (last saved by 'Lailey'), matching LNK and BAT obfuscation, and pCloud API use consistent with past APT37 activity. The Hacker News notes NarwhalRAT departs from the group's usual RokRAT. No CVE is involved; the chain relies on user execution of a LNK file and living-off-the-land binaries.
MITRE ATT&CK techniques used in TL-2026-4944
Collection
T1005 Data from Local System; T1025 Data from Removable Media; T1056.001 Keylogging; T1074.001 Local Data Staging; T1113 Screen Capture; T1123 Audio Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1564.001 Hidden Files and Directories; T1620 Reflective Code Loading
Persistence
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.006 Python; T1106 Native API; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1573.001 Symmetric Cryptography
collection
Initial Access
Affected products and versions in APT37 NarwhalRAT
- Microsoft — Windows
Vulnerable versions: Windows endpoints that run the LNK/BAT/PowerShell chain (no specific version stated in the source)
Remediation for APT37 NarwhalRAT
Immediate actions
- Block the listed IPs and domains at the perimeter and DNS, and review proxy logs for the relay URL paths /wp-content/uploads/2017/02/member.php and /data/editor/2110/index.php
- Hunt for the scheduled task MicrosoftUserInterfacePicturesUpdateTackMachine and for userscreen.exe running from C:\Users\Public\AccountPictures\UserInerfacePicture
- Hunt for the %APPDATA%\naverwhale hidden folder, *.ent files under %LOCALAPPDATA%\Microsoft\Internet Explorer, and C:\ProgramData\GoogleDriveUpdateCheck\AccountConfig.cat
- Isolate affected hosts and reset credentials typed on them, since keystrokes were captured
Workarounds
- Disable or restrict Windows Script Host and PowerShell for standard users where feasible
- Use application control to block execution from C:\Users\Public and ProgramData
Longer-term hardening
- Deploy EDR with behavioral detection for LNK to cmd/PowerShell chains, curl.exe copied or renamed, and pythonw.exe running from user-writable paths
- Block or warn on LNK files inside ZIP archives at the mail gateway
- Restrict or monitor outbound access to api.pcloud.com where it is not a business need
- Train users on Microsoft-account and OTP-themed security-notice lures
Timeline of APT37 NarwhalRAT
- Per Genians' May 2026 report, North Korea reorganized its Reconnaissance General Bureau in September 2025 (day not stated in the source); background context for the APT37 activity that followed
- Decoy HWP document in the related APT37 Python backdoor campaign (police-impersonation lure, latest sample identified mid-April 2026) last saved by the 'Lailey' account, the same metadata Genians later matched in the NarwhalRAT decoy
- Compile timestamp (18:07:49 KST) of the decrypted NarwhalRAT PE payload carried in AccountConfig.cat
- Genians publishes its report on an APT37-linked Python backdoor campaign using LNK/BAT/.cat chains, shared relay infrastructure (fe01.co.kr, 211.239.157.126, 218.150.78.198) and the 'Lailey' document metadata
- Genians Security Center publishes its analysis naming the malware NarwhalRAT and attributing it to APT37
- The Hacker News and UV Cyber report on the campaign, noting NarwhalRAT is a departure from APT37's typical RokRAT
Sources cited for APT37 NarwhalRAT
- Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2 (Genians)
- Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign (Genians)
- Fake Microsoft Alerts Used to Deploy NarwhalRAT (The Hacker News)
- APT37 Strikes Again, This Time with NarwhalRAT (CircleID)
- Active Exploitation Alert: North Korean APT37 Uses Fake Microsoft Account Alerts and LNK Files to Deploy NarwhalRAT (Rescana)
- Hackers Use LNK Files, PowerShell, and Python Loader to Deploy NarwhalRAT (Cyber Security News)
- Hackers Use LNK Files, PowerShell, and Python Loader to Deploy NarwhalRAT (VPN Central)
- Threat Advisory: DPRK Social Engineering (UV Cyber)
- LOLBAS Project (referenced by Genians for curl.exe abuse)
Detection coverage for TL-2026-4944
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4944 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.