Threat reportAPTTL-2026-4945
Suspected APT37 Python Backdoor Delivered via AI Deepfake Impersonation Spear-Phishing Campaign
Suspected APT37 Python Backdoor Delivered via AI Deepfake (TL-2026-4945), also tracked as Python-in-a-Cat, is a high-severity advanced persistent threat campaign, first published 2026-11-01. It is attributed to APT37 (North Korea) with medium confidence, affects Microsoft Windows (LNK shortcut, cmd.exe, PowerShell, Task Scheduler, maps to 16 MITRE ATT&CK techniques (T1005, T1027.010, T1033), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 1APT37
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4945
- Threat ID
- TL-2026-4945
- Also known as
- Python-in-a-Cat, AI Deepfake Impersonation Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- APT37
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, police - law enforcement, research, think tanks
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Suspected APT37 Python Backdoor Delivered via AI Deepfake
Malware and tooling: IoT Reaper, RemCom
How Suspected APT37 Python Backdoor Delivered via AI Deepfake works
Genians reports a suspected APT37 (North Korea) spear-phishing campaign that delivers ZIP-compressed LNK files impersonating officials and institutions. A chain of obfuscated batch scripts, curl.exe and a legitimate Python 3.10 Embed runtime installs a compiled-Python remote command execution backdoor persisted by a scheduled task. Targets include defense and security personnel, North Korea researchers, unification-studies organizations and police investigators.
Genians Security Center (report dated 2026-05-11) analyzed an April 2026 campaign, assessed as suspected APT37 (ScarCruft / Reaper / Ricochet Chollima), that follows its earlier AI deepfake military-ID forgery campaign (Genians, 2025-09-15). Spear-phishing emails use context-specific lures: airline e-tickets, North Korea research event invitations, defense-official and police-investigator impersonation, and portal-service email ID conflict notifications. The lure is a ZIP archive containing an LNK file disguised as a work document.
Stage 1-2: The LNK embeds a command obfuscated with environment-variable substring expansion (for example %a9390f0:~offset,1%), which rebuilds 'cmd.exe /k' and a PowerShell invocation using '-executionpolicy bypass' character by character. A missing path separator in the command creates a file at %LOCALAPPDATA%\TempRpJjgMB.exe. Stage 3: curl.exe is copied from C:\Windows\System32 to %LOCALAPPDATA% as RpJjgMB.exe and used to download follow-on payloads from the C2 at kmot.co.kr/board.php. Stage 4: two files are fetched together, a decoy HWP document (a cybercrime reporting system ECRM form, shown to the victim) and a batch script GuFLjO7q.bat that runs in the background.
Stage 5-6: The batch script downloads python-3.10.0-embed-amd64.zip from python.org, extracts it to C:\Users\Public\Music\MusicLibrariesPackage, deletes python.exe, renames pythonw.exe to codeflush.exe, and downloads settingenv.cat from the C2. settingenv.cat is a compiled Python 3.10 hash-based .pyc (magic 6F 0D 0D 0A, flags 01 00 00 00, hash field zeroed) disguised with a .cat extension. A scheduled task named MicrosoftMusicLibrariesPackageTaskMachine runs 'codeflush.exe settingenv.cat' every minute, surviving reboots and process termination.
Backdoor behavior: the decompiled code hides strings with chr() construction and [::-1] reversal, and resolves __import__ indirectly via getattr(__builtins__, '__import__') to conceal the os, base64, urllib.request, urllib.parse, sys and io modules. It builds a victim identifier from os.getlogin() plus a predefined string, Base64-encodes it into an HTTP Cookie header, and sends HTTP POST requests to kmot.co.kr/board.php. The server returns Base64-encoded Python code, which is run with exec() while stdout is redirected to io.StringIO(); the output is Base64-encoded and returned to the C2. Genians describes the capabilities as file collection, system information theft and dynamic command execution.
Attribution (suspected, per Genians): reuse of IP 51.158.21.1 across 2024-2026 campaigns; repeated Cafe24 hosting and French .fr domains (choisy.fr, versonnex74.fr); the same environment-variable batch obfuscation since 2022; recurring batch/CAB naming patterns (_ms3360.bat, _pK3772.bat, _wS1825.bat, WStemp163.cab, MStemp109.cab); the HWP metadata creator account 'Lailey' seen in 2022 unification council and Seoul UN human rights office lures and in the April 2026 police lure; near-identical PHP webshell structure on compromised sites (hanainternational.net 2022, udcontest.com 2021, printory.kr 2026); and overlap of 114.207.246.156 with ableinfo.co.kr infrastructure. No CVE is exploited in this campaign; CVE-2018-15982 is mentioned in the source only in connection with APT37's 2020 attacks. No CVSS applies. BeaconBeagle returned HTTP 404 for 51.158.21.1, so no C2 correlation was available.
MITRE ATT&CK techniques used in TL-2026-4945
Collection
Defense Evasion
T1027.010 Command Obfuscation; T1036.003 Rename Legitimate Utilities; T1036.008 Masquerade File Type; T1140 Deobfuscate/Decode Files or Information
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Persistence
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.006 Python; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1132.001 Standard Encoding
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
Affected products and versions in Suspected APT37 Python Backdoor Delivered via AI Deepfake
- Microsoft — Windows (LNK shortcut, cmd.exe, PowerShell, Task Scheduler, curl.exe)
Vulnerable versions: Hosts where the victim opens the LNK from a ZIP archive - Hancom — Hangul Word Processor (HWP) - decoy document format
Remediation for Suspected APT37 Python Backdoor Delivered via AI Deepfake
Immediate actions
- Block the listed domains and IP addresses at the perimeter and DNS, and hunt proxy/DNS logs for kmot.co.kr/board.php
- Search endpoints for C:\Users\Public\Music\MusicLibrariesPackage, codeflush.exe, settingenv.cat and the MicrosoftMusicLibrariesPackageTaskMachine scheduled task
- Hunt for curl.exe copied or renamed outside System32 (for example %LOCALAPPDATA%\RpJjgMB.exe)
- Quarantine mailboxes holding ZIP attachments that contain LNK files
Workarounds
- Restrict creation of scheduled tasks by non-administrative users
- Restrict outbound access from user workstations to python.org downloads of embeddable runtimes where not business-justified
Longer-term hardening
- Deploy behavior-based EDR able to detect obfuscated batch commands and multi-stage download abuse, as Genians recommends
- Block execution of LNK files launched from archives or email attachments
- Alert on pythonw.exe or renamed Python runtimes running from user-writable or Public paths
- Train staff in defense, security, police and North Korea research roles on impersonation and deepfake-enabled lures
Timeline of Suspected APT37 Python Backdoor Delivered via AI Deepfake
- Year-only date (2020): APT37 exploited Adobe Flash vulnerabilities via OLE objects in HWP documents and used the Chinotto malware family (per Genians).
- Year-only date (2022): Campaigns impersonating the National Unification Advisory Council and the Seoul UN Human Rights Office; HWP metadata creator account 'Lailey' and environment-variable batch obfuscation first linked.
- Hauri published 'Persistent Threat Attacks by the APT37 Group', cited by Genians for earlier APT37 activity.
- Genians published 'AI-Driven Deepfake-Based Military ID Forgery APT Campaign', whose environment-variable batch obfuscation resembles this campaign.
- Month-level date (March 2026): North Korea's Ministry of State Security was renamed the State Intelligence Bureau, per Yonhap as cited by Genians.
- Month-level date (April 2026): Campaign impersonating police officials delivers ZIP/LNK lures that install the Python backdoor.
- Genians Security Center publishes its analysis of the Python backdoor campaign, attributing it to suspected APT37.
- SecurityOnline and other outlets report on the Genians findings.
Sources cited for Suspected APT37 Python Backdoor Delivered via AI Deepfake
- Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign (Genians Security Center)
- APT37 phishing campaign, Python malware and obfuscation (SecurityOnline)
- Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign (SOC Prime)
- Python Backdoor Threat Analysis intel (detections.ai)
- North Korea-Linked Hackers Deploy AI Deepfake Spear-Phishing Campaign Targeting Korean Officials (MDToday)
Detection coverage for TL-2026-4945
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4945 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4945
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.