ScarCruft (APT37) active in South Korea.pdf

**Executive summary:** This KISC presentation documents ScarCruft (APT37/Ricochet Chollima) targeted espionage activity against Korean-focused victims, describing the infection chain (phishing → decoy documents/macros → malicious scripts → Chinotto/Golang malware), detailed TTPs (DLL side-loading, BITSAdmin, VNC/UltraVNC, Ably channels), C2 artifacts and exfiltration methods, plus IOCs and a Defend Forward incident response process for monitoring, takedown and detection rule development.