APT37__2022__Internet_Explorer_0-day_exploited_by_North_Korean_actor_APT37.pdf

Google TAG describes an Internet Explorer JScript engine zero-day (CVE-2022-41128) actively exploited by North Korea–linked APT37 to deliver post-exploitation implants via malicious Microsoft Office documents that load remote RTF templates; the blog provides exploit analysis, delivery/behavior details (JIT type confusion, custom shellcode, cookie checks, cache clearing), and indicators including file hashes and C2 domains.