ScarCruft
MITRE G0054Also known as APT37, Reaper
Reports
4
First seen
May 5, 2026
Last seen
Aug 10, 2026
Motivation
Espionage
Targeting
Sectors
Victim regions
China ×1
Top ATT&CK techniques
T1041 Exfiltration Over C2 Channel ×3T1486 Data Encrypted for Impact ×2T1078 Valid Accounts ×2T1059.003 Command and Scripting Interpreter: Windows Command Shell ×2T1566 Phishing ×2T1110 Brute Force ×2T1190 Exploit Public-Facing Application ×2T1555 Credentials from Password Stores ×1T1566.001 Phishing: Spearphishing Attachment ×1T1113 Screen Capture ×1T1566.002 Phishing: Spearphishing Link ×1T1021 Remote Services ×1
Indicators
cve ×46domain ×12email ×12ip_v4 ×7url ×5filename ×2hash_sha1 ×1hash_md5 ×1
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
High