APT37
No sourced public emblem in this profile.
reference profile · reported nexus: KP (not nationality)
APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities
Source-reported aliases: APT 37, Group 123, Group123, InkySquid, Operation Daybreak, Operation Erebus, Reaper Group, Reaper, Red Eyes, Ricochet Chollima, ScarCruft, Venus 121, ATK4, G0067, Moldy Pisces, APT-C-28, PLAIN NEPTUNE. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
South Korea · 
Japan · 
Vietnam
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.fireeye.com/blog/threat-research/2018/02/apt37-overlooked-north-korean-actor.html
https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf
https://twitter.com/mstoned7/status/966126706107953152
https://www.cfr.org/interactive/cyber-operations/apt-37
https://unit42.paloaltonetworks.com/unit42-freemilk-highly-targeted-spear-phishing-campaign/
https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html
https://attack.mitre.org/groups/G0067/
https://securelist.com/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/75082/
https://securelist.com/operation-daybreak/75100/
https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/
https://threatpost.com/scarcruft-apt-group-used-latest-flash-zero-day-in-two-dozen-attacks/118642/
https://unit42.paloaltonetworks.com/atoms/moldypisces/
https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/