⚠️ Overview

Gremlin is a Python-based information stealer first documented by the AhnLab Security Emergency Response Center (ASEC) in early 2022, and is attributed to a North Korean threat cluster tracked as APT37 (RedEyes). It is classified as a stealer and loader, initially distributed through spear-phishing emails containing malicious Hangul Word Processor (HWP) attachments targeting South Korean think tanks and government entities.

🔧 Technical Capabilities

Gremlin uses an HWP document exploiting CVE-2017-8291 (a remote code execution vulnerability in Hangul Word Processor) to drop an initial loader that fetches the primary payload from a remote C2 server. The malware is written entirely in Python and compiled into a Windows executable using PyInstaller; it employs AES encryption for C2 communications and uses a custom domain generation algorithm (DGA). Persistence is achieved by creating a scheduled task that runs the executable at logon, and evasion techniques include checking for sandbox environments by verifying screen resolution and the presence of debugger tools. Gremlin collects browser credentials, saved passwords from Chrome and Edge, screenshots, and system information, then exfiltrates data over HTTP POST requests to attacker-controlled domains.

📜 History & Notable Incidents

First observed in February 2022 during campaigns against South Korean national security experts by APT37, Gremlin was later linked to a broader campaign tracked by Mandiant as "UNC2980" that targeted organizations in South Korea, Japan, and the United States. In November 2023, a variant of Gremlin was found to use a new payload that also deployed the RokRAT backdoor, indicating ongoing development by the threat group. No CVEs beyond CVE-2017-8291 have been directly associated, but the malware continues to be used in low-volume, highly targeted attacks as of early 2024.

🔍 Detection Indicators

Known file hashes include SHA-256 D3E0B1A2C4F5E6... (example from ASEC report) but specific hashes are not publicly maintained due to rapid variant changes. Behavioral indicators include the creation of a scheduled task named "WindowsUpdateScheduler" and outbound HTTP connections to domains mimicking legitimate Korean news sites. Network IOCs include User-Agent strings such as "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" and POST payloads encrypted with a static AES key.

☠️ Risk & Impact

Gremlin primarily exfiltrates credentials, intellectual property, and system metadata from compromised endpoints, contributing to long-term espionage campaigns by North Korean threat actors. The affected sectors are predominantly government, defense, and research institutions in South Korea and East Asia. Financial losses are indirect, mainly involving the cost of incident response and loss of classified data, with the highest impact observed in the theft of policy research documents.

🛡️ Mitigation

Defenders should apply patches for CVE-2017-8291 on all Hangul Word Processor installations, enable macro-blocking for HWP documents, and deploy YARA rules detecting PyInstaller-compiled Python binaries with embedded AES keys. Network detection can use Snort signatures targeting the static User-Agent strings and the exfiltration pattern of base64-encoded POST bodies to unknown domains.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.