Into-the-Cumulus-Scarcruft-bolsters-arsenal-for-targeting-individu_7cWxwip.pdf (4 MB)

S2W's Virus Bulletin paper attributes Cumulus, also called RambleOn, to Scarcruft/APT37 and frames it as an Android extension of the group's ROKRAT tooling. The malware has targeted individual Android users since at least 2019, building on earlier Scarcruft mobile operations against North Korean human rights officials, North Korea-focused journalists, and South Korean journalists approached through KakaoTalk, Facebook, Google Play, or WeChat. Cumulus is distributed as legitimate-looking APKs such as messengers, image viewers, or coin-mining apps, then uses FCM or Pushy messaging and separate Clugin plug-ins to receive commands and leak data. S2W also recovered cloud-stored attacker test data, victim conversations, distribution guidance, an attacker IP, and unpublished Clugin samples.