APT37 Hackers Deploy New Malware to Breach Air-Gapped Networks

Security researchers have identified a new malware campaign attributed to APT37, a North Korean state-linked threat actor, targeting air-gapped environments. The operation demonstrates increasingly sophisticated techniques designed to bypass physical network isolation controls and exfiltrate sensitive data from high-security systems.

Who is APT37?

APT37, also known by aliases such as “Reaper” and “ScarCruft,” is a cyber-espionage group widely assessed to operate on behalf of North Korean intelligence services. The group has historically focused on:

• Government agencies
• Defense contractors
• Diplomatic entities
• Critical infrastructure organizations

The group is known for blending social engineering, custom malware development, and long-term persistence tactics to support strategic intelligence collection objectives.

Targeting Air-Gapped Networks

Air-gapped systems—networks physically isolated from the internet—are commonly used to protect highly sensitive environments such as military command systems, industrial control systems (ICS), nuclear facilities, and classified research networks.

Because these systems lack direct internet connectivity, adversaries must rely on indirect infection vectors. The newly discovered APT37 malware reportedly leverages:

• Removable storage devices (USB drives)
• Cross-network data staging mechanisms
• Multi-stage payload deployment
• Covert data transfer channels

These techniques enable attackers to move laterally between connected and isolated environments, effectively bridging the “air gap.”

Technical Capabilities of the Malware

Preliminary analysis indicates the malware includes modules capable of:

• Harvesting system configuration and credential data
• Monitoring file system activity
• Encrypting and staging exfiltrated data
• Executing remote commands once connectivity is re-established

In many air-gap breach scenarios, infected removable drives act as transfer intermediaries. Data is collected within the isolated network, written to portable media, and then extracted when the device is later connected to an internet-facing system.

Operational Implications

The campaign underscores that air-gapping alone is not a foolproof defense. Threat actors are increasingly exploiting human workflows—particularly the movement of removable media between secure and non-secure environments—to bypass isolation controls.

This approach mirrors historical attacks on industrial and defense networks, where physical security measures were circumvented through supply chain compromise or insider-enabled infection vectors.

Strategic Significance

The emergence of new air-gap–targeting malware aligns with North Korea’s broader cyber strategy, which combines espionage, intellectual property theft, and strategic intelligence gathering. Such campaigns can support:

• Military modernization objectives
• Sanctions evasion activities
• Technology acquisition efforts
• Political intelligence collection

The targeting of isolated networks suggests a high-value objective, as these environments typically house classified or mission-critical data.

Defensive Recommendations

Organizations operating air-gapped systems should consider strengthening controls around removable media usage and cross-network workflows, including:

• Strict USB device control and monitoring
• Media scanning in dedicated quarantine environments
• Data diode or one-way transfer solutions
• Enhanced user activity logging
• Behavior-based endpoint detection in isolated networks

Defense-in-depth strategies remain essential, as physical separation alone cannot eliminate risk from advanced persistent threat (APT) actors.

Conclusion

The newly uncovered malware campaign attributed to APT37 highlights the evolving sophistication of state-sponsored cyber operations. By developing tools specifically designed to exploit removable media pathways and bridge network isolation barriers, the group continues to expand its operational reach into some of the most secure digital environments.

The incident reinforces the need for continuous monitoring, supply chain vigilance, and adaptive security controls in high-security sectors worldwide.