source_3916.pdf (8 MB)

WhoisXML API analyzed infrastructure from an APT37 campaign that delivered the Python-based NarwhalRAT through spear-phishing messages and malicious LNK files. The malware supports keylogging, screen capture, USB collection, and remote command execution, while its operators used a Korean relay server and the pCloud API as a dead-drop resolver. DNS and WHOIS analysis of five domain and six IP indicators uncovered 888 connected artifacts, but the researchers said those additional domains had not been weaponized and required further investigation. The sample PDF discloses three original domain indicators and three original IP indicators, which are preserved separately from the unconfirmed expansion set.