2025-01-10ììëìë³ê³ìAPT37ììììí¼ì.pdf (947 KB)

HAURI describes APT37 reconnaissance phishing against people connected to North Korea issues and defector communities. The attack embeds an IMG tag in email so that opening the message automatically reaches a phishing site, while compromised legitimate Korean sites are used to avoid security blocking. One example uses an alumni-list update lure and a dalcommusic.com URL with encrypted parameters; the phishing infrastructure blocks crawler and bot user agents and writes access data to crawl.dat, supporting targeted-delivery and tracking detections.