We’ve identified further, clear connections between #RambleOn Android malware and #APT37.

In 2022 we uncovered a new novel Android malware campaign targeting journalists working on the advocacy of NK human rights at @nknewsorg.

Ref: interlab.or.kr/archives/2567

🧵1/6

Last month @S2W_Official published additional research on #RambleOn, finding other variants of it and highlighting code similarities between a 2017 campaign operated by #APT37 which used a Android variant of #Rokrat Malware

2/6

Note: @S2W_Official Renamed RambleOn malware to Culumus. Reasons for which are unknown.

3/6

After some additional research and historic sample gathering, we have identified a clear and progressive iteration of #ROKRAT Malware evolving into being used as the stage two payload in #RambleOn starting in 2018.

4/6

In addition, we’ve found near exact code correlations between these payloads progressively from 2017 till 2023.

5/6

Next week we will release these findings. We are confident that based on these that RambleOn has been an operation of APT37 and began by evolving ROKRAT in 2018.

6/6