[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3EK-ZtQRvevKR278oJ0S_kLwYPu9-VQffEzahKua3ao":3},{"article":4,"iocs":43,"watch_terms":53,"solutions":54,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"3bb06651-4fce-41ac-84b9-102d5523f22d","Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware","fake-microsoft-alerts-used-to-deploy-north-korean-narwhalrat-malware-954607","The North Korean state-sponsored hacking group known as ScarCruft (aka APT37) has been observed using spear-phishing messages impersonating Microsoft Account security notifications to deliver malware called NarwhalRAT. \"The attack email contained a message impersonating an MS account security alert,\" the Genians Security Center (GSC) said. \"It was designed to create concern over possible","North Korean state-sponsored group ScarCruft (APT37) is deploying a new Python-based remote access trojan called NarwhalRAT via spear-phishing emails impersonating Microsoft Account security alerts. The attack uses a multi-stage infection chain starting with LNK files in ZIP archives that download batch scripts, which then retrieve the malware payload and establish persistence through scheduled tasks. The malware communicates with C2 servers using Korean websites and pCloud cloud storage as a dead drop resolver.","ScarCruft uses fake Microsoft alerts to deliver NarwhalRAT malware to targets.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Ffake-microsoft-alerts-used-to-deploy.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg3Lf-lxaztGp4Ov5_hu7TmA6AEoqhh2oBADVLVEbA1HTzmsAyX9ePZtZvvBlBzNym1RiifCmOnb-pf604J7plqPdarQxnW-m6Ds0Wi-kT1Ytqm1KlGsf4hWmL8YPa17MXv4yxcEN0CwkA_9qwbEGn74XdX4Y0J4t1rR3oflfW5cpy2tXo65kVMFI3oRFxr\u002Fs1600\u002Fms-alert.jpg","2026-06-16T08:14:55+00:00","2026-06-16T10:00:12.490857+00:00",9,[17,20,22,25],{"name":18,"type":19},"ScarCruft","threat_actor",{"name":21,"type":19},"APT37",{"name":23,"type":24},"Microsoft","vendor",{"name":26,"type":24},"Naver Corporation","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,50],{"type":45,"value":46,"context":47},"domain","daehoat.com","Primary C2 communication relay used by NarwhalRAT",{"type":45,"value":49,"context":47},"novel21.co.kr",{"type":31,"value":51,"context":52},"NarwhalRAT","Python-based remote access trojan deployed by ScarCruft; stages data in %APPDATA%\\naverwhale directory",[23,26],{"controls":55,"vendors":142},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":86,"name":87,"problem":88,"products":89},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":115,"name":116,"problem":117,"products":118},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[119,127,134],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":128,"vendor_name":23,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":160},"north-korean-apt37-uses-fake-microsoft-alerts-to-deploy-narwhalrat-via-spear-phishing","North Korean APT37 Uses Fake Microsoft Alerts to Deploy NarwhalRAT via Spear-Phishing","ScarCruft (APT37) exploited users' trust in legitimate Microsoft security communications to trick targets into executing malicious LNK files disguised as routine account alerts. The multi-stage infection chain — from ZIP archive to LNK to batch script to RAT — is designed to evade simple detection and establish durable persistence via scheduled tasks. This attack highlights how effective social engineering remains when combined with convincing impersonation of trusted brands. The use of legitimate cloud infrastructure (pCloud) as a C2 dead drop resolver further obscures malicious traffic, making detection without robust behavioral monitoring extremely difficult. Organizations that lack email authentication controls and user training are particularly vulnerable to this class of nation-state threat.",[148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-61 – Incident Response","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AT-2 – Security Awareness Training","NIST SP 800-53 SC-7 – Boundary Protection","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment","MITRE ATT&CK T1053.005 – Scheduled Task\u002FJob","MITRE ATT&CK T1102 – Web Service (Dead Drop Resolver)","ITIL – Problem Management (root cause of recurring phishing incidents)","GDPR Article 32 – Security of Processing (protecting personal data from unauthorized access)",{}]