2026-05-28
ESET
ESET APT Activity Report Q4 2025–Q1 2026
#Andariel
#DangerousPassword
#DeceptiveDevelopment
#DreamJob
#Rook
#ScarCruft
ScarCruft
"ScarCruft Threat Actor Intelligence Profile"
- Cybergeist, https://cybergeist.io/profile/scarcruft
Also known as
| Name | Named by | AKA | First seen | Last seen |
|---|---|---|---|---|
| APT-C-28 | Qihoo360 | ScarCruft | 2019-06-01 | 2026-02-06 |
| APT-Q-3 | Qianxin | Group123 | 2022-03-23 | 2023-07-11 |
| APT37 | Mandiant | ScarCruft | 2018-02-20 | 2026-05-10 |
| ATK4 | ThalesGroup | APT37 | 2019-10-07 | 2022-05-31 |
| BlackShoggoth | PWC | APT37 | 2020-03-03 | 2021-02-28 |
| ChinopuNK | S2W | ScarCruft | 2025-08-07 | 2025-08-07 |
| DEV-0215 | Microsoft | ScarCruft | 2022-11-07 | 2022-11-07 |
| DogpuNK | S2W | ScarCruft | 2025-08-07 | 2025-08-07 |
| EarthManticore | TrendMicro | APT37 | 2025-03-18 | 2026-04-16 |
| G0067 | MITRE | APT37 | 2018-04-18 | 2018-04-18 |
| Group123 | CiscoTalos | ScarCruft | 2018-01-16 | 2025-05-14 |
| ITG10 | IBM | ScarCruft | 2021-10-23 | 2023-06-06 |
| InkySquid | Volexity | ScarCruft | 2021-08-17 | 2023-01-04 |
| Lawrencium | Microsoft | DEV-0215 | 2023-04-18 | 2023-04-18 |
| MoldyPisces | PaloaltoNetworks | TEMP.Reaper | 2021-09-30 | 2021-09-30 |
| NickelFoxcroft | SecureWorks | ScarCruft | - | 2024-10-08 |
| PearlSleet | Microsoft | Lawrencium | 2023-04-19 | 2023-04-18 |
| RedEyes | Ahnlab | ScarCruft | 2018-02-21 | 2024-05-07 |
| RicochetChollima | CrowdStrike | ScarCruft | 2019-02-19 | 2026-01-28 |
| ScarCruft | Kaspersky | - | 2016-06-17 | 2026-05-28 |
| SectorA02 | NSHC | ScarCruft | 2020-03-12 | 2025-04-16 |
| SquidWerewolf | BiZone | APT37 | 2025-03-12 | 2025-03-12 |
| TA-RedAnt | Ahnlab | RedEyes | 2024-10-16 | 2025-10-20 |
| TEMP.Reaper | Mandiant | ScarCruft | 2018-02-03 | 2024-04-09 |
| UCID902 | InterLab | 금성121 | 2023-04-12 | 2025-02-10 |
| puNK-006 | S2W | ScarCruft | 2025-08-07 | 2025-08-07 |
| 금성121 | ESTSecurity | ScarCruft | 2018-07-04 | 2023-09-19 |
Reports
2024-03-07
UN
S/2024/215 Final report of the Panel of Experts
#CyberLink #JumpCloud #Andariel #Kimsuky #BlueNoroff #ScarCruft #Alphapo #CoinsPaid #Merlin #Steadefi #Fantom #Terraport #UnoRe #HECO #HTX #OrbitBridge #Poloniex #NexusMutual #Indodax #CoinEx #bZx #Qubit #DeFiance #Bondly #Fetchai #MGNR #EasyFi #FinNexus #Eterbase #KuCoin #Cryptopia #AlgoCapital #CoinTiger #BiKi #CoinBene #Gateio #Coinrail #Bancor #Tradeio #CoinSecure #Cypherium #Taylor #Sanctions
UN
S/2024/215 Final report of the Panel of Experts
#CyberLink #JumpCloud #Andariel #Kimsuky #BlueNoroff #ScarCruft #Alphapo #CoinsPaid #Merlin #Steadefi #Fantom #Terraport #UnoRe #HECO #HTX #OrbitBridge #Poloniex #NexusMutual #Indodax #CoinEx #bZx #Qubit #DeFiance #Bondly #Fetchai #MGNR #EasyFi #FinNexus #Eterbase #KuCoin #Cryptopia #AlgoCapital #CoinTiger #BiKi #CoinBene #Gateio #Coinrail #Bancor #Tradeio #CoinSecure #Cypherium #Taylor #Sanctions