NarwhalRAT is a Python-based RAT attributed to APT37, targeting Korean users through spear phishing emails that mimic Microsoft security alerts. The infection chain involves LNK files embedded in ZIP archives and BAT script obfuscation, leading to multi-stage loaders that deploy the RAT. The malware features capabilities including keylogging, screen capture, microphone recording, and USB data theft. It uses a dual C2 infrastructure with Korean relay servers (daehoat.com, novel21.co.kr) and the pCloud API as a dead-drop resolver for command and control. The malware creates encrypted configuration files, implements anti-VM detection, and maintains persistence via scheduled tasks. It executes code in memory to avoid file-based detection and operates under manual control with selective activation of features via C2 commands. Indicators include multiple domains and IP addresses linked to the infrastructure. There are no known patches or fixes as this is malware rather than a software vulnerability.

The malware enables attackers to perform extensive espionage activities including capturing keystrokes, screenshots, audio recordings, and exfiltrating data from USB devices. It establishes persistent access and evades detection through anti-VM techniques and in-memory execution. The dual C2 infrastructure and dead-drop resolver increase operational resilience and stealth. This compromises confidentiality and privacy of targeted users, primarily in Korea.

No official patches or fixes exist as this is malware. Defenders should focus on user awareness to recognize spear phishing attempts, especially those impersonating Microsoft alerts. Network monitoring for the identified C2 domains and IP addresses can help detect and block communications. Endpoint detection solutions should be tuned to identify LNK file abuse, BAT script obfuscation, and suspicious scheduled tasks. Employing anti-malware tools capable of detecting in-memory execution and behavioral anomalies is recommended. Since the malware uses manual control, timely detection can prevent further malicious activity.