# APT37 NarwhalRAT: MS-Themed Phishing and pCloud Dead-drop C2 Targeting Korean Users

> Genians reports APT37 (ScarCruft) spear phishing impersonating the Microsoft Account Team to deliver a ZIP-packed malicious LNK that launches an obfuscated BAT/PowerShell chain deploying NarwhalRAT, a Python-based RAT. The RAT executes an encrypted PE in memory and uses a pCloud API dead-drop resolver plus compromised Korean relay servers for C2, with keylogging, screen capture, microphone recording, USB data collection, remote command execution and file transfer.

- **Published:** 2026-11-01T01:29:31Z
- **Last reviewed:** 2026-11-01T01:29:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4944
- **ID:** TL-2026-4944
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT37 (North Korea)
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In June 2026 Genians Security Center published an analysis of a new APT37 campaign that distributes a compiled Python-based RAT it named NarwhalRAT (from the hard-coded 'naverwhale' working directory). Delivery starts with a spear-phishing email titled '[Urgent] Security Check Notice Regarding Repeated One-Time Password (OTP) Generation', sent as the 'Microsoft Account Team'. The ZIP 'Cybersecurity Advisory Notice (Regarding One-Time Password Abuse).zip' is downloaded via a relay on fe01.co.kr and contains a LNK of the same name. The LNK hides its command line with CMD environment-variable substring substitution (variable a805aae), runs cmd.exe /k into PowerShell with -ExecutionPolicy Bypass, copies C:\Windows\System32\curl.exe to a non-standard path (uARKK20.exe) and downloads two files from webhostingkorea.com using 'contents' and 'board' parameters. A decoy HWP document with the same name is opened for the victim.

The second stage, KHjWFcsE.bat (obfuscated with variable a1373ro), downloads Python-3.10.0-embed-amd64.zip to C:\Users\Public\temp012.zip, extracts it to C:\Users\Public\AccountPictures\UserInerfacePicture, renames pythonw.exe to userscreen.exe and fetches config.cat, which is Python bytecode (magic 6F 0D 0D 0A) disguised as a Windows catalog file. Persistence is a scheduled task named MicrosoftUserInterfacePicturesUpdateTackMachine that runs userscreen.exe against config.cat at one-minute intervals.

config.cat uses chr() reconstruction, reversed strings ([::-1]) and getattr(__builtins__, '__import__') to hide strings. It downloads a second container, AccountConfig.cat (about 33,000 lines of obfuscated Python, stored under C:\ProgramData\GoogleDriveUpdateCheck), which it decrypts with a custom XOR scheme using a counter-based SHA-256 KDF (seed 'aHAnLLtQrP8Ce'). The result is a PE that is loaded fileless through Python ctypes (VirtualAlloc with PAGE_EXECUTE_READWRITE, RtlMoveMemory, CFUNCTYPE). The PE compile timestamp is 2026-04-30 18:07:49 KST. The malware checks CPUID hypervisor vendor strings for VMware, VirtualBox and Parallels, and uses mutex i5zJH9FL10cVd3sSW9eyWWErPJ. Its configuration is stored AES-128 encrypted (CryptoAPI, SHA-256 + CryptDeriveKey) in %LOCALAPPDATA%\Microsoft\Internet Explorer\<random>.ent.

C2 is dual-channel: HTTP relay scripts on compromised Korean sites (www.daehoat.com/wp-content/uploads/2017/02/member.php and www.novel21.co.kr/data/editor/2110/index.php) and the legitimate api.pcloud.com API, queried with folderid= and auth= parameters, as a dead-drop resolver for the live C2 address. The RAT supports 30+ command prefixes, including startscap:/endscap: (screen), startkcap:/endkcap: (keylog), startmicn:/endmicn: (microphone), usb2local: (USB copy via xcopy to C:\Users\Public\<random>), cmd:/cmdadm: (execution) and cmserver:/caserver:/cdserver:/chcommpwd: (reconfigure C2 servers and communication password). Collected data is staged in a hidden/system %APPDATA%\naverwhale folder and uploaded sequentially. Keylogging excludes KakaoTalk helper windows. Genians assesses the targets to be Korean users, citing the Naver Whale directory name, KakaoTalk filtering, HWP decoys and Korean-language lures.

Genians attributes the activity to APT37 based on shared C2 relays (fe01.co.kr, 211.239.157.126, 218.150.78.198) with its 2026-05-11 report on a Python backdoor campaign, identical decoy-document metadata (last saved by 'Lailey'), matching LNK and BAT obfuscation, and pCloud API use consistent with past APT37 activity. The Hacker News notes NarwhalRAT departs from the group's usual RokRAT. No CVE is involved; the chain relies on user execution of a LNK file and living-off-the-land binaries.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1106 Native API
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1620 Reflective Code Loading
- T1497.001 System Checks
- T1056.001 Keylogging
- T1113 Screen Capture
- T1123 Audio Capture
- T1005 Data from Local System
- T1025 Data from Removable Media
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1102.001 Dead Drop Resolver
- T1573.001 Symmetric Cryptography
- T1119 Automated Collection

## Sources

- [Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2 (Genians)](https://www.genians.co.kr/en/blog/threat_intelligence/narwhalrat)
- [Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign (Genians)](https://www.genians.co.kr/en/blog/threat_intelligence/python)
- [Fake Microsoft Alerts Used to Deploy NarwhalRAT (The Hacker News)](https://thehackernews.com/2026/06/fake-microsoft-alerts-used-to-deploy.html)
- [APT37 Strikes Again, This Time with NarwhalRAT (CircleID)](https://circleid.com/posts/apt37-strikes-again-this-time-with-narwhalrat)
- [Active Exploitation Alert: North Korean APT37 Uses Fake Microsoft Account Alerts and LNK Files to Deploy NarwhalRAT (Rescana)](https://www.rescana.com/post/active-exploitation-alert-north-korean-apt37-uses-fake-microsoft-account-alerts-and-lnk-files-to-deploy-narwhalrat-malwa)
- [Hackers Use LNK Files, PowerShell, and Python Loader to Deploy NarwhalRAT (Cyber Security News)](https://cybersecuritynews.com/powershell-and-python-loader-to-deploy-narwhalrat/)
- [Hackers Use LNK Files, PowerShell, and Python Loader to Deploy NarwhalRAT (VPN Central)](https://vpncentral.com/hackers-use-lnk-files-powershell-and-python-loader-to-deploy-narwhalrat/)
- [Threat Advisory: DPRK Social Engineering (UV Cyber)](https://www.uvcyber.com/hubfs/ThreatAdvisory-DPRK-Social-Engineering-16JUN26.pdf)
- [LOLBAS Project (referenced by Genians for curl.exe abuse)](https://github.com/LOLBAS-Project/LOLBAS)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4944