ESET researchers have published a new report on “Dolphin”, a previously unreported backdoor malware that was first identified in April 2021. North Korean advanced persistent threat (APT) group ScarCruft (aka APT37 or Reaper) has been utilizing the malware in highly targeted operations for over a year and often in conjunction with the backdoor “BLUELIGHT”, which is used to launch Dolphin’s Python loader. ScarCruft often targets South Korean military and government organizations, but also focuses on additional Asian countries as well as companies in other industries that align with North Korean interests. Dolphin has various spying capabilities, including “monitoring drives and portable devices and exfiltrating files of interest, keylogging and taking screenshots, and stealing credentials from browsers.” The malware also collects usernames, the computer name, local and external IP address, RAM size and usage, operating system version, installed security software, and more. Researchers noted that Dolphin is a C++ executable that uses Google Drive for command-and-control (C2) communication, as well as to store exfiltrated data. It also establishes persistence by modifying the Windows Registry and modifies the settings of its victims’ signed-in Google and Gmail accounts (in order to lower their security and maintain access). Dolphin’s capabilities extend to any mobile device that is connected to the compromised host by using the Windows Portable Device API. Dolphin is continuing to evolve and advance its capabilities, and a technical deep dive as well as current indicators of compromise (IOCs) can be viewed in ESET’s report linked below.