# Suspected APT37 Python Backdoor Delivered via AI Deepfake Impersonation Spear-Phishing Campaign

> Genians reports a suspected APT37 (North Korea) spear-phishing campaign that delivers ZIP-compressed LNK files impersonating officials and institutions. A chain of obfuscated batch scripts, curl.exe and a legitimate Python 3.10 Embed runtime installs a compiled-Python remote command execution backdoor persisted by a scheduled task. Targets include defense and security personnel, North Korea researchers, unification-studies organizations and police investigators.

- **Published:** 2026-11-01T01:56:56Z
- **Last reviewed:** 2026-11-01T01:56:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4945
- **ID:** TL-2026-4945
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT37 (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Genians Security Center (report dated 2026-05-11) analyzed an April 2026 campaign, assessed as suspected APT37 (ScarCruft / Reaper / Ricochet Chollima), that follows its earlier AI deepfake military-ID forgery campaign (Genians, 2025-09-15). Spear-phishing emails use context-specific lures: airline e-tickets, North Korea research event invitations, defense-official and police-investigator impersonation, and portal-service email ID conflict notifications. The lure is a ZIP archive containing an LNK file disguised as a work document.

Stage 1-2: The LNK embeds a command obfuscated with environment-variable substring expansion (for example %a9390f0:~offset,1%), which rebuilds 'cmd.exe /k' and a PowerShell invocation using '-executionpolicy bypass' character by character. A missing path separator in the command creates a file at %LOCALAPPDATA%\TempRpJjgMB.exe. Stage 3: curl.exe is copied from C:\Windows\System32 to %LOCALAPPDATA% as RpJjgMB.exe and used to download follow-on payloads from the C2 at kmot.co.kr/board.php. Stage 4: two files are fetched together, a decoy HWP document (a cybercrime reporting system ECRM form, shown to the victim) and a batch script GuFLjO7q.bat that runs in the background.

Stage 5-6: The batch script downloads python-3.10.0-embed-amd64.zip from python.org, extracts it to C:\Users\Public\Music\MusicLibrariesPackage, deletes python.exe, renames pythonw.exe to codeflush.exe, and downloads settingenv.cat from the C2. settingenv.cat is a compiled Python 3.10 hash-based .pyc (magic 6F 0D 0D 0A, flags 01 00 00 00, hash field zeroed) disguised with a .cat extension. A scheduled task named MicrosoftMusicLibrariesPackageTaskMachine runs 'codeflush.exe settingenv.cat' every minute, surviving reboots and process termination.

Backdoor behavior: the decompiled code hides strings with chr() construction and [::-1] reversal, and resolves __import__ indirectly via getattr(__builtins__, '__import__') to conceal the os, base64, urllib.request, urllib.parse, sys and io modules. It builds a victim identifier from os.getlogin() plus a predefined string, Base64-encodes it into an HTTP Cookie header, and sends HTTP POST requests to kmot.co.kr/board.php. The server returns Base64-encoded Python code, which is run with exec() while stdout is redirected to io.StringIO(); the output is Base64-encoded and returned to the C2. Genians describes the capabilities as file collection, system information theft and dynamic command execution.

Attribution (suspected, per Genians): reuse of IP 51.158.21.1 across 2024-2026 campaigns; repeated Cafe24 hosting and French .fr domains (choisy.fr, versonnex74.fr); the same environment-variable batch obfuscation since 2022; recurring batch/CAB naming patterns (_ms3360.bat, _pK3772.bat, _wS1825.bat, WStemp163.cab, MStemp109.cab); the HWP metadata creator account 'Lailey' seen in 2022 unification council and Seoul UN human rights office lures and in the April 2026 police lure; near-identical PHP webshell structure on compromised sites (hanainternational.net 2022, udcontest.com 2021, printory.kr 2026); and overlap of 114.207.246.156 with ableinfo.co.kr infrastructure. No CVE is exploited in this campaign; CVE-2018-15982 is mentioned in the source only in connection with APT37's 2020 attacks. No CVSS applies. BeaconBeagle returned HTTP 404 for 51.158.21.1, so no C2 correlation was available.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1059.006 Python
- T1053.005 Scheduled Task
- T1027.010 Command Obfuscation
- T1036.008 Masquerade File Type
- T1036.003 Rename Legitimate Utilities
- T1140 Deobfuscate/Decode Files or Information
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1584 Compromise Infrastructure

## Sources

- [Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign (Genians Security Center)](https://www.genians.co.kr/en/blog/threat_intelligence/python)
- [APT37 phishing campaign, Python malware and obfuscation (SecurityOnline)](https://securityonline.info/apt37-phishing-campaign-python-malware-obfuscation-genians/)
- [Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign (SOC Prime)](https://socprime.com/active-threats/python-backdoor-threat-analysis/)
- [Python Backdoor Threat Analysis intel (detections.ai)](https://detections.ai/intel-exchange/019e1708-9b4e-778b-81a6-f121c4301b5a)
- [North Korea-Linked Hackers Deploy AI Deepfake Spear-Phishing Campaign Targeting Korean Officials (MDToday)](https://mdtoday.co.kr/news/view/1065564002489167)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4945