NarwhalRAT the threat of APT37 that deceives with security notifications and is activated from LNK files

A North Korean cyberespionage team known as ScarCruft (also referred to as APT37) has been linked to a speed-phishing campaign that suppresses Microsoft account security notifications to induce victims to open a malicious attachment that ends up installing a remote trojan called NarwhalRAT. The technique is not sophisticated in its decoy - a mail that warns of "abnormal activity" in the generation of single-use passwords - but yes in its running chain: a ZIP containing an LNK file that triggers a sequence of intermediate scripts and a Python charger that runs the payload directly in memory.

What is relevant is not only the social decoy, but the technical architecture used by the campaign. The use of a legitimate Python executable downloaded from its official website and a CAT file as part of the flow allows the attacker to evade detections based on simple signatures, while memory execution makes it difficult to analyse and identify by traditional antivirus. Persistence is established by programmed tasks whose names mimic Windows components, a deliberate tactic to pass unnoticed in surface audits.

Capacities attributed to NarwhalRAT are unique to an intelligence collection operation: key recording, high-resolution screenshots, ambient audio recording, copy of directories and USB media content, and execution of remote orders. It also incorporates a multi-C2 mechanism that uses both Korean websites and a legitimate cloud storage service (pCloud) as a secondary channel or "dead drop solve," complicating the simple blacklist of domains.

In strategic terms, the adoption of NarwhalRAT by APT37 means a displacement from previous families attributed to the group (such as RokRAT) and evidence of re-use of tactics: same lures with confirmations of events or tickets, use of LNK tablets, and similar conventions in the planned task names. These patterns help to correlate incidents and contextualize your modus operandi within the panorama of North Korean threats described by public analysts such as MITRE ( https: / / attack.mitre.org / groups / G0062).

Practical involvement for organizations and users is clear: a single click on an LNK sent by mail can start a chain that will not leave clear artifacts on disk and will quickly allow the continuous exfiltration of sensitive information. In addition, the use of cloud services as a C2 layer complicates the identification by filtering domains, because traffic may seem legitimate at first sight. Companies with operations on the Korean peninsula or political and defence relations should consider this risk as high.

To reduce exposure, defensive measures must combine prevention, detection and response. In prevention, it is critical to strengthen the protection of email to block ZIP files with LNK or inspect them in sandboxes, impose implementation policies (application of white lists and LNK execution block on download folders) and apply robust MFA for all privileged accounts. In detection, EDR solutions that monitor memory behavior, the creation of scheduled tasks and unusual calls to PIs of cloud services will facilitate early identification. In response, it is appropriate to audit scheduled tasks and persistence points, disconnect committed hosts and perform a forensic analysis in memory before turning off machines.

In addition, security teams should consider network-level restrictions for cloud services not used by the organization, and specific alerts for PCloud APIs communication patterns if the service is not authorized in the corporate environment. Awareness-raising and ongoing training in the face of post posts that appeal to the urgency of "account security" remain a basic but effective barrier; however, in the face of well-orchestrated and targeted campaigns, education must be complemented by technical controls and coordinated responses.

If you think your organization may have been hit, contact your incident response team or security provider, preserve volatile evidence and avoid restarting equipment until forensic analysis allows. For technical information on APT37 and common tactics consult reference sources such as the MITRE knowledge base ( https: / / attack.mitre.org / groups / G0062) and, if you need to understand the service the attackers abuse on their channels, check the public documentation of pCloud ( https: / / www.pcloud).