APT Group 123 Launches Active Attacks on Windows Systems to Deploy Malicious Payloads

The North Korean state-sponsored threat actor known as Group123-also tracked as APT37, Reaper, and ScarCruft-has intensified its campaign against Windows-based environments.

Security researchers report the group is actively exploiting vulnerabilities in office productivity suites, operating systems, and web applications to introduce an array of malicious payloads onto target systems.

While initially focused on South Korea, recent evidence reveals a geographic expansion encompassing Japan, Vietnam, India, the United States, the Middle East, and parts of Europe.

Evolving Threat Landscape

Group123, operational since at least 2012, has cemented its reputation as a major force in cyber espionage.

Its latest campaigns reveal both the breadth and depth of its technical capabilities.

Current intelligence highlights a continued emphasis on intelligence collection from sectors deemed vital to national security interests, such as defense, aerospace, nuclear technology, and engineering.

Cyfirma analysts note that the group’s operations increasingly blur the lines between traditional espionage and financially motivated cybercrime, as evidenced by a spate of ransomware attacks using strains like Maui to supplement state revenue streams.

The group’s attack lifecycle is marked by its tactical flexibility and rapid adoption of newly disclosed vulnerabilities, including the exploitation of high-profile CVEs such as CVE-2018-4878 and CVE-2022-41128.

These vulnerabilities, often affecting browser plugins and office software, have been systematically abused through spear phishing, waterhole attacks, and drive-by compromises.

Group123’s phishing campaigns are highly targeted; malicious documents are crafted to appeal to the specific professional or regional interests of their intended victims, often exploiting the Hangul Word Processor (HWP) and Microsoft Office-platforms deeply integrated into East Asian business environments.

Technical Sophistication

The technical sophistication of Group123’s operations is reflected in its extensive and evolving malware toolkit.

Custom payloads such as ROKRAT, PoohMilk Loader, Oceansalt, and GELCAPSULE are deployed alongside commodity malware and built-in Windows scripting utilities.

These payloads enable persistent access, privilege escalation, lateral movement, and data exfiltration.

The group’s persistence mechanisms include the establishment of covert backdoors, manipulation of registry keys, and strategic modification of system startup configurations.

Recent campaigns also demonstrate the group’s adept use of defense evasion techniques.

Encryption, multi-stage payload delivery, and the use of legitimate services (including cloud platforms and compromised web servers) for command-and-control communication make detection and attribution challenging.

Additional obfuscation is achieved through techniques such as DLL sideloading, call stack spoofing, and payload fragmentation.

Credential theft remains a core component of Group123’s strategy, with the group routinely harvesting browser-stored credentials and leveraging password dumping tools to expand access within victim networks.

Their discovery and reconnaissance phases are thorough, often involving the collection of detailed system information and internal network mapping to identify high-value targets.

Group123’s operational agility and continual adaptation of tactics underscore its status as a persistent threat actor on the global stage.

The group’s capacity to combine classic espionage aims with ransomware-driven financial gain highlights a dangerous convergence of state and criminal cyber operations.

Security experts advise organizations, particularly those in key infrastructure, defense, and research sectors across East Asia and allied states, to maintain heightened vigilance, keep systems patched, and deploy advanced endpoint monitoring to counter Group123’s evolving threat.

With its expanding arsenal, regional reach, and ability to exploit both technical and human vulnerabilities, Group123 is expected to continue posing a formidable challenge to global cybersecurity in the years to come.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates