# Apt37 Reaper

Adversary-emulation profile for APT37 (G0067 / Reaper / ScarCruft / Ricochet Chollima /...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill apt37-reaper -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill apt37-reaper -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill apt37-reaper -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill apt37-reaper -g -a gemini-cli -y`

## Description

Adversary-emulation profile for APT37 (G0067 / Reaper / ScarCruft / Ricochet Chollima / InkySquid / Group123), North Korea's RGB cyber-espionage actor.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# APT37 (Reaper, ScarCruft, Ricochet Chollima, InkySquid), Adversary Emulation Profile

APT37 (MITRE ATT&CK **G0067**) is a North Korean state-sponsored cyber-espionage group active since at least 2012. Tracked as ScarCruft (Kaspersky), Reaper (FireEye), InkySquid (Volexity), Group123 (Cisco Talos), TEMP.Reaper, and Ricochet Chollima (CrowdStrike), APT37 primarily targets South Korean government, military, media, and defector communities, with expanding operations into Japan, Vietnam, the Middle East, and Europe. The group is characterized by aggressive exploitation of zero-day vulnerabilities in Adobe Flash Player, Internet Explorer, and Microsoft Edge; heavy use of weaponized Hangul Word Processor (HWP) documents; strategic web compromises (watering holes); a diverse custom malware arsenal (RoKRAT, BLUELIGHT, Chinotto, Dolphin, DOGCALL); and C2 over legitimate cloud services (Dropbox, pCloud, Yandex, Box, Google Drive). Unlike the higher-profile Lazarus Group, APT37 focuses on targeted intelligence collection and defector surveillance rather than financial theft or destructive operations.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/apt37-reaper/SKILL.md