By 2023, APT37 had shifted to phishing campaigns targeting users on both Windows and Android platforms. Infection Vector: The attack begins with phishing emails containing ZIP attachments that hide malicious LNK files, masquerading as documents related to North Korean affairs or trade agreements. APT37, also known as ScarCruft, Reaper, and Red Eyes, is a North Korean state-sponsored hacking group that has been active since 2012. This data is then exfiltrated to the Command-and-Control (C2) server.