Emanuele De Lucia analyzes an APT37, also known as Group123 or ScarCruft, campaign focused on South Korean targets. The activity used Korean-language spear-phishing, Hanmail addresses, payloads masquerading as JPEG files, and cloud services for command-and-control. The post is useful for defenders tracking APT37 delivery tradecraft, regional targeting, and Android spying backdoor activity.