Peeking at Reaper’s surveillance operations

SEKOIA.IO discovered Reaper (aka APT37) Command-and-Control infrastructure exposing hosted implants and victims' exfiltrated data; their analysis documents credential-harvesting phishing (including 2FA bypass using Ably/PubNub), CHM-based infection vectors that drop PowerShell backdoors, and multiple Chinotto Windows DLL variants performing screenshots, keylogging and targeted data collection/exfiltration. The report includes extensive IoCs (file hashes, URLs, IPs), YARA rules, and attributes the activity to Reaper with high confidence, assessing it as a targeted cyberespionage campaign against North Korean defectors and related civil-society actors.